Getting Started

Overview

This guide covers deploying the Britive Access Broker on a Windows host and registering target Windows servers as resources in Britive Resource Manager. Once complete, the broker is ready for all Windows use cases: temporary local user accounts and remote local group membership for JIT RDP access.

The broker runs as a Windows service and communicates outbound to Britive over HTTPS — no inbound ports are required.

Before You Begin

• A Britive tenant with administrator access
• A Windows Server 2019 or 2022 host to run the broker
• Java 21 (OpenJDK) on the broker host
• A broker pool token from Resource Manager → Broker Pools → New Pool in the Britive console
• Outbound HTTPS (port 443) from the broker host to Britive
• PowerShell remoting (WinRM) enabled on target servers the broker will manage

Broker Service Account

The broker runs as a Windows service. We recommend using a Group Managed Service Account (gMSA) to avoid managing service account passwords manually.

The gMSA needs the following rights on target servers (applied via GPO or Local Security Policy):

Apply via Group Policy Management Console → Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment, then add the gMSA (DOMAIN\svc-britive$).

Install the Broker

java --version

C:\Program Files (x86)\Britive Inc\Britive Broker\

broker_pool_token: "<your-broker-pool-token>"

sc.exe config "BritiveBroker" obj= "CONTOSO\svc-britive$"

$installDir = "C:\Program Files (x86)\Britive Inc\Britive Broker"
$acl = Get-Acl $installDir
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "CONTOSO\svc-britive$", "FullControl",
    "ContainerInherit,ObjectInherit", "None", "Allow"
)
$acl.AddAccessRule($rule)
Set-Acl -Path $installDir -AclObject $acl

Start-Service -Name "BritiveBroker"
Get-Service  -Name "BritiveBroker"
# Status should show: Running

Enable WinRM on Target Servers

The broker manages Windows servers via PowerShell remoting (WinRM). Run on each target server as a local administrator:

Enable-PSRemoting -Force

# Verify from the broker host
Test-WSMan -ComputerName "target-server.contoso.com"

Register Windows Servers as Resources

Create a resource type

resource "britive_resource_manager_resource_type" "windows" {
  name        = "WindowsServer"
  description = "Windows RDP server"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "port"
    param_type   = "string"
    is_mandatory = true
  }
}

Register a server

resource "britive_resource_manager_resource" "winserver" {
  name          = "prod-win-01"
  description   = "Production Windows server"
  resource_type = britive_resource_manager_resource_type.windows.name

  parameter_values = {
    hostname = "prod-win-01.contoso.com"
    port     = "5985"
  }

  resource_labels = {
    environment = "Production"
    team        = "platform"
  }
}

Verify

# On the broker host: confirm the service is running
Get-Service -Name "BritiveBroker"

# Check the Windows event log for broker startup
Get-EventLog -LogName Application -Source "BritiveBroker" -Newest 10

In the Britive console:

Troubleshoot

Next Steps

• Temporary Local User Access — create and delete temporary local accounts for JIT RDP
• Local Group Access — add users to local groups (e.g. Remote Desktop Users) for JIT RDP