Local Group Access

Overview

Rather than creating a temporary local account, this pattern grants JIT access by adding the requesting user’s existing domain account to a local group (e.g. Remote Desktop Users or Administrators) on a remote Windows server. At checkin, the user is removed from the group.

This pattern is preferred when:

Users already have domain accounts and just need temporary server access
You want to avoid creating local accounts on servers
Audit trails should reference the user’s real identity

Before You Begin

The broker is running and connected (see Getting Started)
WinRM is enabled on the target Windows server
The broker service account has local administrator rights on the target server (to modify local group membership remotely)

Checkout Routine

Full script: Windows/permissions/local-admin-remote-server/checkout.ps1

Environment variables:

Variable	Notes
`user`	Injected — requesting user’s UPN (e.g. `jdoe@contoso.com`)
`target`	Target server hostname or FQDN
`group`	Local group name (e.g. `Remote Desktop Users`, `Administrators`)

Add domain user to local group via WinRM:

Windows/permissions/local-admin-remote-server/checkout.ps1

$UserUPN        = $env:user
$TargetComputer = $env:target
$TargetGroup    = $env:group

Invoke-Command -ComputerName $TargetComputer -ScriptBlock {
    param($RemoteUser, $GroupName)
    Add-LocalGroupMember -Group $GroupName -Member $RemoteUser -ErrorAction Stop
    Write-Output "User $RemoteUser added to group $GroupName"
} -ArgumentList $UserUPN, $TargetGroup

Checkin Routine

Full script: Windows/permissions/local-admin-remote-server/checkin.ps1

Windows/permissions/local-admin-remote-server/checkin.ps1

$UserUPN        = $env:user
$TargetComputer = $env:target
$TargetGroup    = $env:group

Invoke-Command -ComputerName $TargetComputer -ScriptBlock {
    param($RemoteUser, $GroupName)
    Remove-LocalGroupMember -Group $GroupName -Member $RemoteUser -ErrorAction Stop
    Write-Output "User $RemoteUser removed from group $GroupName"
} -ArgumentList $UserUPN, $TargetGroup

Add-LocalGroupMember and Remove-LocalGroupMember accept UPN format (user@domain.com) directly when the server is domain-joined. No pre-existing local account is created or required.

Multi-Server Access

To grant access to multiple servers from a single profile, set target as a variable on the resource rather than the permission. Each registered Windows server resource can carry its own target value, and the same checkout/checkin routines apply to all of them.

Configure in Britive

Create a permission

Go to Resource Manager → Resource Type Permissions → New Permission. Set Language to PowerShell.

Paste checkout.ps1 and checkin.ps1 into the Checkout and Checkin fields.

Declare variables:

Variable	System defined	Notes
`user`	Yes	Injected automatically — the requesting user’s UPN
`target`	No	Set per resource or on the permission
`group`	No	e.g. `Remote Desktop Users` or `Administrators`

Create a profile

Go to Resource Manager → Profiles → New Profile. Set an expiration (e.g. 2h). Under Associations, select the resource label(s) covering the target Windows servers. Under Permissions, add the permission above.

Add a policy

Under Policies, assign members (users or tags) and configure approval conditions as needed.

windows-local-group.tf

# Resource type — defines the WindowsServer class
resource "britive_resource_manager_resource_type" "windows" {
name        = "WindowsServer"
description = "Windows server with WinRM access"

parameters {
  param_name   = "hostname"
  param_type   = "string"
  is_mandatory = true
}
parameters {
  param_name   = "target"
  param_type   = "string"
  is_mandatory = true
}
}

# Permission — local group checkout/checkin routines
resource "britive_resource_manager_resource_type_permission" "local_group" {
name             = "Windows-LocalGroup-Access"
resource_type_id = britive_resource_manager_resource_type.windows.id
description      = "JIT RDP access via local group membership"
code_language    = "PowerShell"
show_orig_creds  = true

checkout_code_file = "${path.module}/scripts/checkout.ps1"
checkin_code_file  = "${path.module}/scripts/checkin.ps1"

variables = ["user", "target", "group"]
}

# Resource label — categorize servers by environment
resource "britive_resource_manager_resource_label" "env" {
name        = "environment"
description = "Deployment environment"
label_color = "#2563eb"

values { name = "Production";  description = "Production servers" }
values { name = "Staging";     description = "Staging servers" }
}

# Resource — a specific Windows server
resource "britive_resource_manager_resource" "win01" {
name          = "prod-win-01"
description   = "Production Windows server"
resource_type = britive_resource_manager_resource_type.windows.name

parameter_values = {
  hostname = "prod-win-01.internal"
  target   = "prod-win-01"
}

resource_labels = {
  environment = "Production"
}
}

# Profile — JIT local group membership profile
resource "britive_resource_manager_profile" "local_group" {
name                = "Windows-LocalGroup-Access"
description         = "JIT RDP access via domain user local group membership"
expiration_duration = 7200000   # 2 hours in milliseconds

associations {
  label_key = "environment"
  values    = ["Production"]
}
}

# Profile permission — link profile to the local group permission
resource "britive_resource_manager_profile_permission" "local_group" {
profile_id = britive_resource_manager_profile.local_group.id
name       = britive_resource_manager_resource_type_permission.local_group.name
version    = "latest"

variables {
  name              = "group"
  value             = "Remote Desktop Users"
  is_system_defined = false
}
}

# Profile policy — who can check out
resource "britive_resource_manager_profile_policy" "local_group" {
profile_id  = britive_resource_manager_profile.local_group.id
policy_name = "Windows-LocalGroup-Policy"

members = jsonencode({
  tags             = [{ name = "windows-users" }]
  users            = []
  serviceIdentities = []
  aiIdentities     = []
})

condition   = jsonencode({ ipAddress = null, timeOfAccess = null })
access_type = "Allow"
consumer    = "resourceprofile"
is_active   = true
is_draft    = false
}

Verify

Check out the profile

Navigate to My Access → find the profile → Check Out.

Confirm group membership on the target server

Invoke-Command -ComputerName "prod-win-01" -ScriptBlock {
    Get-LocalGroupMember -Group "Remote Desktop Users"
}
# The requesting user's UPN should appear in the output

Connect via RDP

Connect using the user’s existing domain credentials — the server now allows RDP for this user.

Check in

Return to My Access → Check In.

Confirm membership is removed

Invoke-Command -ComputerName "prod-win-01" -ScriptBlock {
    Get-LocalGroupMember -Group "Remote Desktop Users"
}
# The user should no longer appear

Troubleshoot

Symptom	Cause	Fix
`Invoke-Command` access denied	Broker gMSA lacks WinRM access to target	Add gMSA to target’s `Remote Management Users` group or local `Administrators`
`Add-LocalGroupMember` fails — member not found	UPN format not recognized on non-domain server	Ensure the target server is domain-joined and the user account exists in AD
User still has RDP access after checkin	Checkin routine failed silently	Check broker logs; run `Remove-LocalGroupMember` manually to recover
`target` variable empty	Not set on the resource or permission	Add `target` as a variable on the resource parameter or permission configuration

Last updated on July 8, 2026

EC2 Instance Access (SSM)Browser-Based RDP via Bridge