Demos / Security and compliance
Demo · 1:43
Safe by design
Roles decide who can do what: the help desk is refused Domain Admins, the auditor sees everything and runs nothing.
Recorded on the real product against our demo company, Lakefront Works. The people and data are fictional.
Transcript
PowerScripts holds the permissions, so nobody on the help desk needs admin rights of their own. Harry gets exactly the scripts his role allows. On Rick Vaughn's menu, Harry can add him to groups. There is no script here for Domain Admins: that one isn't in Harry's role.
Even if he types Domain Admins into the everyday group script, it refuses. Privileged groups have their own script, granted separately. Nothing changed. Now a genuine mistake. Harry meant the VPN group, but adds Rick to the server admins group instead.
No ticket to the AD team. He opens the run on the audit trail, clicks Reverse, and PowerScripts runs the remove script with the same values. Rick is out of server admins, and both runs are on the record.
Alan, the administrator, adds the privileged group script from the catalog to Lakefront's library. Because it's marked privileged, it isn't added to anyone's role.
Script Access shows the difference. The everyday script is with the Active Directory role. The privileged one: only administrators, until Alan grants it to someone on purpose.
Olaf is the auditor. He sees every run: Harry's refused attempt, the mistake and the undo, with who, when and which ticket. But there's nothing for him to run. No scripts on his menus, by role. Same app, same permissions, and everyone gets only what their role allows.