How to customize permission for a group on Windows Server?

Question

I want to create a "restricted" administrator group that can only run the privileged PowerShell cmdlet Get-RemoteAccessConnectionStatistics. Does Windows Server support such level of granularity? And in general, how do I create a customized security group (specifying which task members can perform and which they can't)? (Not in AD.)

Answer 1

You should look into Just Enough Administration, with it you can restrict users to perform certain administrative tasks without being a member of the administrator group.

You need to learn a bit about JEA first, but it is a powerful new tool to limit what administrators can do.