Temporary Local User Access

Overview

At checkout, the broker creates (or resets) a temporary local user account on the target Windows server, adds it to a specified local group (e.g. Remote Desktop Users), and returns the username and password. At checkin, the account is deleted and any active RDP sessions can optionally be terminated.

This pattern requires no AD infrastructure — the account is local to the server.

Before You Begin

The broker is running and connected (see Getting Started)
WinRM is enabled on the target Windows server
The broker service account has local administrator rights on the target server

Checkout Routine

Full script: Windows/permissions/temp-local-user/checkout.ps1

Environment variables:

Variable	Notes
`email`	Injected — requesting user’s email; username is derived by stripping the domain
`group`	Local group to add the account to (e.g. `Remote Desktop Users`)

Derive username, generate password, create account:

Windows/permissions/temp-local-user/checkout.ps1

$email    = $env:email
$username = ($email.Split('@')[0]) -replace '[^a-zA-Z0-9]', ''
$group    = $env:group

$chars    = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*"
$password = -join ((0..11) | ForEach-Object { $chars[(Get-Random -Maximum $chars.Length)] })
$securePass = ConvertTo-SecureString $password -AsPlainText -Force

$existing = Get-LocalUser -Name $username -ErrorAction SilentlyContinue
if ($existing) {
    $existing | Set-LocalUser -Password $securePass
} else {
    New-LocalUser -Name $username -Password $securePass | Out-Null
}

Add to local group and return credentials:

Windows/permissions/temp-local-user/checkout.ps1

Add-LocalGroupMember -Group $group -Member $username

# Return credentials via response template
Write-Output "username:s:$username"
Write-Output "password:s:$password"

The username:s: and password:s: format is compatible with .rdp file syntax, making it easy to surface these as a ready-to-use RDP connection file.

Checkin Routine

Full script: Windows/permissions/temp-local-user/checkin.ps1

Environment variables:

Variable	Default	Notes
`email`	—	Injected — same as checkout
`killrdp`	`0`	Set to `1` to terminate active RDP sessions before deleting the account

Optionally kill RDP sessions, then delete the account:

Windows/permissions/temp-local-user/checkin.ps1

$username = ($env:email.Split('@')[0]) -replace '[^a-zA-Z0-9]', ''
$killrdp  = if ($env:killrdp) { $env:killrdp } else { "0" }

if ($killrdp -eq "1") {
    # Terminate active RDP sessions for this user
    $sessions = (qwinsta $username 2>&1) -split "`r`n" |
        Where-Object { $_ -match "\b$username\b" }
    $sessions | ForEach-Object {
        $id = ($_ -split '\s+')[3]
        Invoke-RDUserLogoff -HostServer localhost -UnifiedSessionID $id -Force
    }
}

# Remove the local user account
Get-LocalUser -Name $username -ErrorAction SilentlyContinue |
    Remove-LocalUser -ErrorAction SilentlyContinue

Configure in Britive

Create a response template

Go to Resource Manager → Response Templates → New Template. Add fields that surface username and password from the checkout output.

Create a permission

Go to Resource Manager → Resource Type Permissions → New Permission. Set Language to PowerShell.

Paste checkout.ps1 and checkin.ps1 into the Checkout and Checkin fields.

Declare variables:

Variable	System defined	Notes
`email`	Yes	Injected automatically
`group`	No	e.g. `Remote Desktop Users` or `Administrators`
`killrdp`	No	`0` or `1`

Under Response Templates, attach the template you created.

Create a profile

Go to Resource Manager → Profiles → New Profile. Set an expiration (e.g. 2h). Under Associations, select the resource label(s) covering the target Windows servers. Under Permissions, add the permission above.

Add a policy

Under Policies, assign members (users or tags) and configure approval or time-of-access conditions as needed.

windows-temp-user.tf

# Response template — surfaces username and password
resource "britive_resource_manager_response_template" "rdp_creds" {
name                     = "RDP-Credentials"
description              = "Returns local username and password on checkout"
show_on_ui               = true
is_console_access_enabled = false
template_data            = "Username: {{username}}\nPassword: {{password}}"
}

# Resource type — defines the WindowsServer class
resource "britive_resource_manager_resource_type" "windows" {
name        = "WindowsServer"
description = "Windows server with WinRM access"

parameters {
  param_name   = "hostname"
  param_type   = "string"
  is_mandatory = true
}
}

# Permission — temp local user checkout/checkin routines
resource "britive_resource_manager_resource_type_permission" "temp_user" {
name             = "Windows-TempUser-Access"
resource_type_id = britive_resource_manager_resource_type.windows.id
description      = "JIT RDP access via temporary local user account"
code_language    = "PowerShell"

checkout_code_file = "${path.module}/scripts/checkout.ps1"
checkin_code_file  = "${path.module}/scripts/checkin.ps1"

variables          = ["email", "group", "killrdp"]
response_templates = [britive_resource_manager_response_template.rdp_creds.name]
}

# Resource label — categorize servers by environment
resource "britive_resource_manager_resource_label" "env" {
name        = "environment"
description = "Deployment environment"
label_color = "#2563eb"

values { name = "Production";  description = "Production servers" }
values { name = "Staging";     description = "Staging servers" }
}

# Resource — a specific Windows server
resource "britive_resource_manager_resource" "win01" {
name          = "prod-win-01"
description   = "Production Windows server"
resource_type = britive_resource_manager_resource_type.windows.name

parameter_values = {
  hostname = "prod-win-01.internal"
}

resource_labels = {
  environment = "Production"
}
}

# Profile — JIT temporary user access profile
resource "britive_resource_manager_profile" "temp_user" {
name                = "Windows-TempUser-Access"
description         = "JIT RDP access via temporary local account"
expiration_duration = 7200000   # 2 hours in milliseconds

associations {
  label_key = "environment"
  values    = ["Production"]
}
}

# Profile permission — link profile to the temp user permission
resource "britive_resource_manager_profile_permission" "temp_user" {
profile_id = britive_resource_manager_profile.temp_user.id
name       = britive_resource_manager_resource_type_permission.temp_user.name
version    = "latest"

variables {
  name              = "group"
  value             = "Remote Desktop Users"
  is_system_defined = false
}
variables {
  name              = "killrdp"
  value             = "0"
  is_system_defined = false
}
}

# Profile policy — who can check out
resource "britive_resource_manager_profile_policy" "temp_user" {
profile_id  = britive_resource_manager_profile.temp_user.id
policy_name = "Windows-TempUser-Policy"

members = jsonencode({
  tags             = [{ name = "windows-users" }]
  users            = []
  serviceIdentities = []
  aiIdentities     = []
})

condition   = jsonencode({ ipAddress = null, timeOfAccess = null })
access_type = "Allow"
consumer    = "resourceprofile"
is_active   = true
is_draft    = false
}

Verify

Check out the profile

Navigate to My Access → find the profile → Check Out. Username and password appear in the response.

Connect via RDP

Open Remote Desktop Connection (mstsc.exe) and enter the target server hostname. Use the credentials from the checkout response.

Check in

Return to My Access → Check In.

Confirm the account is removed

Get-LocalUser -Name "<username>"
# Expected: Get-LocalUser : User <username> was not found.

Troubleshoot

Symptom	Cause	Fix
Checkout routine fails with access denied	Broker gMSA lacks local admin rights on target	Add gMSA to target’s local `Administrators` group via GPO
`New-LocalUser` fails — user already exists	Previous checkin did not remove the account	Check broker checkin logs; manually remove with `Remove-LocalUser`
RDP connection refused after checkout	Account not in `Remote Desktop Users`	Confirm `group` variable is set to `Remote Desktop Users`
Account not deleted at checkin	Checkin routine error	Check broker logs; verify WinRM is reachable from broker
`Invoke-RDUserLogoff` not found	Running on a non-RDS server	Ensure the Remote Desktop Services role or RSAT is installed, or set `killrdp=0`

Last updated on July 8, 2026

Getting Started EC2 Instance Access (SSM)