Limitations of PowerShell JEA: No Automatic Credential Refresh in Persistent Sessions

Background

PowerShell Just Enough Administration (JEA) enables least‑privilege remote sessions by constraining users to a predefined command set. A JEA session is typically created with a RunAsCredential that points to a service account. The session remains alive as long as the runspace is open.

Unresolved Behavior

When the service account’s password expires, or its Kerberos ticket lapses mid‑session, the remote runspace does not automatically re‑authenticate. Subsequent commands fail with authentication errors, and PowerShell provides no built‑in event or hook to detect the expiration while the session is active. PowerShell 7.x improves error reporting for authentication failures but still lacks a mechanism to refresh credentials or notify the session owner.

Key Constraints

• JEA configurations cannot be updated on‑the‑fly; a new session configuration must be created if the RunAsCredential changes.
• Credential expiration handling depends on domain Kerberos policies and local security settings, not on PowerShell itself.
• Custom heartbeat checks or exception handling (e.g., PSRemotingTransportException) are the only documented ways to detect expiration.

Open Questions

• Is there a PowerShell‑level API or event that can be subscribed to for detecting credential expiration in an active JEA runspace?
• Could a future PowerShell release introduce automatic renewal of Kerberos tickets for persistent JEA sessions?
• What best‑practice patterns exist for gracefully closing or re‑establishing JEA sessions when the underlying service account password is about to expire?