We have a group of users that have an operator role on the web server and need only to be able to see the status of the application pools within Internet Information Server.

They do not need other access on the machine, and are therefore not member of the local administrators group. Currently they can't access IIS manager because of that.

Is there a way to make this possible (for example via a script, tool or specific user right assignment)?


You can use PowerShell's JEA (Just Enough Administration).

You first need to set up JEA on the server and configure an JEA endpoint for this scenario.

The users need to have an account on the server, but just a normal user account, they don't need to be administrators.

In the capabilities file, you just need to allow just enough to get the job done:

VisibleCmdlets = 'Get-WebAppPoolState'
VisibleProviders = 'Variable'

Then your users can use a remote PowerShell session to connect to the server and all they can do is run: Get-WebAppPoolState, nothing else.

This requires learning JEA and how to configure the server, but knowing this can be helpful in many situations where you want to give limited access to users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.