Elevated Access: Just-in-Time Accounts
Just-In-Time (JIT) Accounts for Elevated Access
Overview
Just-In-Time (JIT) accounts provide secure, auditable elevated access without the risks associated with permanent or shared administrator accounts. Each JIT account is uniquely tied to an individual user and is automatically managed to ensure security and compliance.
Instead of relying on shared local admin accounts, JIT accounts allow administrators and engineers to temporarily elevate privileges, with all actions logged under their specific identity.
Key Features of JIT Accounts
- User-Specific Accountability
Every elevated action is recorded under the unique JIT account linked to a user’s identity, ensuring full auditability.
- Event Viewer Visibility
- This ensures you always know who performed which action.
- Provides a complete audit trail for compliance and troubleshooting.
Unlike shared accounts where actions are unattributable, all activity performed through a JIT account is logged in Windows Event Viewer under the specific JIT username (derived from the user’s email).
- Automatic Expiration
- JIT accounts remain valid for 30 days from the time of creation.
- After 30 days of inactivity, the account is automatically deleted.
- Idle Session Controls
- If a JIT account is not actively in use, it is automatically disabled after 10 minutes of inactivity.
- Upon logout or after closing all active sessions, the account is removed from the Administrators group and disabled.
- Secure Credential Handling
- Each login session generates a random 25-character password (containing lowercase, uppercase, numbers, and symbols).
- The password is known only to Windows—neither Evo nor the user ever has access to it.
- A new password is generated for every login session.
- Username Format
- JIT accounts are created based on the user’s email address.
- Since Windows usernames are limited to 20 characters, the account name is truncated to fit this requirement.
How It Works
- A user selects Elevated Login and enters their Evo credentials (email + Evo password).
- The system automatically provisions a JIT account tied to the user’s email.
- A long, randomized password is generated for the account, and the user is logged in.
- During the session, all actions are logged in Event Viewer under the JIT username.
- After the session ends or 10 minutes of inactivity:
- The account is disabled.
- The user is removed from the Administrators group.
- After 30 days without use, the JIT account is permanently deleted.
Benefits of JIT Accounts
- Eliminates the need for shared or static admin credentials.
- Provides per-user accountability for all privileged activity.
- Ensures traceability in Event Viewer, linking every action to an individual user.
- Reduces the risk of credential compromise by rotating passwords automatically.
- Enforces least privilege principles with time-bound elevated access.
