Citrix Virtual Apps and Desktops SDK

Get-BrokerAccessPolicyRule

Gets rules from the site’s access policy.

Syntax

Get-BrokerAccessPolicyRule
   [[-Name] <String>]
   [-AllowedConnections <AllowedConnection>]
   [-AllowedUsers <AllowedUser>]
   [-Description <String>]
   [-DesktopGroupName <String>]
   [-DesktopGroupUid <Int32>]
   [-Enabled <Boolean>]
   [-ExcludedClientIPFilterEnabled <Boolean>]
   [-ExcludedClientName <String>]
   [-ExcludedClientNameFilterEnabled <Boolean>]
   [-ExcludedSmartAccessFilterEnabled <Boolean>]
   [-ExcludedSmartAccessTag <String>]
   [-ExcludedUser <User>]
   [-ExcludedUserFilterEnabled <Boolean>]
   [-IncludedClientIPFilterEnabled <Boolean>]
   [-IncludedClientName <String>]
   [-IncludedClientNameFilterEnabled <Boolean>]
   [-IncludedSmartAccessFilterEnabled <Boolean>]
   [-IncludedSmartAccessFilterType <String>]
   [-IncludedSmartAccessTag <String>]
   [-IncludedUser <User>]
   [-IncludedUserFilterEnabled <Boolean>]
   [-Metadata <String>]
   [-Property <String[]>]
   [-ReturnTotalRecordCount]
   [-MaxRecordCount <Int32>]
   [-Skip <Int32>]
   [-SortBy <String>]
   [-Filter <String>]
   [-FilterScope <Guid>]
   [<CitrixCommonParameters>]
   [<CommonParameters>]
<!--NeedCopy-->
Get-BrokerAccessPolicyRule
   [-Uid] <Int32>
   [-Property <String[]>]
   [<CitrixCommonParameters>]
   [<CommonParameters>]
<!--NeedCopy-->

Description

Returns rules matching the specified search criteria from the site’s access policy. If no search criteria are specified, all rules in the access policy are obtained.

An access policy rule defines a set of connection filters and access control rights relating to a desktop group. These allow fine-grained control of what access is granted to a desktop group based on details of, for example, a user’s endpoint device, its address, and the user’s identity.

————————– BrokerAccessPolicyRule Object

A BrokerAccessPolicyRule object represents a single rule within the site’s access policy. For a user to gain access to a desktop group via the rule their connection must match all its enabled include filters, and none of its enabled exclude filters. The object contains the following properties:

  • AllowedConnections (Citrix.Broker.Admin.SDK.AllowedConnection)

    Controls whether connections must be local or via Access Gateway, and if so whether specified SmartAccess tags must be provided by Access Gateway with the connection. This property forms part of the included SmartAccess tags filter. For a detailed description of this property see “help about_Broker_AccessPolicy”.

  • AllowedProtocols (System.String[])

    Protocols (for example HDX, RDP) available to the user for sessions delivered from the rule’s desktop group. If the user gains access to a desktop group by multiple rules, the allowed protocol list is the combination of the protocol lists from all those rules. If the protocol list is empty, access to the desktop group is implicitly denied.

  • AllowedUsers (Citrix.Broker.Admin.SDK.AllowedUser)

    Controls the behavior of the included users filter. This can restrict access to a list of named users or groups, or allow access to any authenticated user. For a detailed description of this property see “help about_Broker_AccessPolicy”.

  • AllowRestart (System.Boolean)

    Indicates if the user can restart sessions delivered from the rule’s desktop group. Session restart is handled as follows: For sessions on single-session power-managed machines, the machine is powered off, and a new session launch request made; for sessions on multi-session machines, a logoff request is issued to the session, and a new session launch request made; otherwise the property is ignored.

  • AppProtectionKeyLoggingRequired (System.Boolean)

    Specifies whether key logging app protection is required.

  • AppProtectionScreenCaptureRequired (System.Boolean)

    Specifies whether screen capture app protection is required.

  • Description (System.String)

    An optional description of the rule. The text is purely informational for the administrator, it is never visible to the end user.

  • DesktopGroupName (System.String)

    The name of the desktop group to which the rule applies.

  • DesktopGroupUid (System.Int32)

    The unique ID of the desktop group to which the rule applies.

  • Enabled (System.Boolean)

    Indicates whether the rule is enabled. A disabled rule is ignored when evaluating the site’s access policy.

  • ExcludedClientIPFilterEnabled (System.Boolean)

    Indicates whether the excluded client IP filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • ExcludedClientIPs (Citrix.Broker.Admin.SDK.ChbIPAddressRange[])

    IP addresses of user devices explicitly denied access to the rule’s desktop group. Addresses can be specified as simple numeric addresses or as subnet masks (for example, 10.40.37.5 or 10.40.0.0/16). This property forms part of the excluded client IP address filter.

  • ExcludedClientNameFilterEnabled (System.Boolean)

    Indicates whether the excluded client name filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • ExcludedClientNames (System.String[])

    Names of user devices explicitly denied access to the rule’s desktop group. This property forms part of the excluded client names filter.

  • ExcludedSmartAccessFilterEnabled (System.Boolean)

    Indicates whether the excluded SmartAccess tags filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • ExcludedSmartAccessTags (System.String[])

    SmartAccess tags which explicitly deny access to the rule’s desktop group if any occur in those provided by with the user’s connection. This property forms part of the excluded SmartAccess tags filter.

  • ExcludedUserFilterEnabled (System.Boolean)

    Indicates whether the excluded users filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • ExcludedUsers (Citrix.Broker.Admin.SDK.ChbUser[])

    Users and groups who are explicitly denied access to the rule’s desktop group. This property forms part of the excluded users filter.

  • HdxSslEnabled (System.Boolean)

    Indicates whether TLS encryption is enabled for sessions delivered from the rule’s desktop group.

  • IncludedClientIPFilterEnabled (System.Boolean)

    Indicates whether the included client IP filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • IncludedClientIPs (Citrix.Broker.Admin.SDK.ChbIPAddressRange[])

    IP addresses of user devices allowed access to the rule’s desktop group. Addresses can be specified as simple numeric addresses or as subnet masks (for example, 10.40.37.5 or 10.40.0.0/16). This property forms part of the included client IP address filter.

  • IncludedClientNameFilterEnabled (System.Boolean)

    Indicates whether the included client names filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • IncludedClientNames (System.String[])

    Names of user devices allowed access to the rule’s desktop group. This property forms part of the included client names filter.

  • IncludedSmartAccessFilterEnabled (System.Boolean)

    Indicates whether the included SmartAccess tags filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • IncludedSmartAccessFilterType (System.String)

    Indicates whether all tags present in IncludedSmartAccessTags must match tags provided by the user’s connection to grant access (MatchAll), or whether any tag matching is sufficient (MatchAny).

  • IncludedSmartAccessTags (System.String[])

    The SmartAccess tags which grant access to the rule’s desktop group if they occur in those provided with the user’s connection. If multiple tags are specified, access also depends on the IncludedSmartAccessFilterType setting. This property forms part of the included SmartAccess tags filter.

  • IncludedUserFilterEnabled (System.Boolean)

    Indicates whether the included users filter is enabled. If the filter is disabled it is ignored when the rule is evaluated.

  • IncludedUsers (Citrix.Broker.Admin.SDK.ChbUser[])

    Users and groups who are granted access to the rule’s desktop group. This property forms part of the included users filter.

  • MetadataMap (System.Collections.Generic.Dictionary<string, string>)

    A collection of arbitrary key/value pairs that can be associated with the rule. The administrator can use these values for any purpose; they are not used by the site itself in any way.

  • Name (System.String)

    Administrative name of the rule. Each rule in the site’s access policy must have a unique name.

  • Uid (System.Int32)

    Unique ID of the rule itself.

Examples

EXAMPLE 1

Returns all access policy rules. This offers a complete description of the current site’s access policy.

Get-BrokerAccessPolicyRule
<!--NeedCopy-->

EXAMPLE 2

Returns all rules that are both enabled and explicitly include the SALES\tech-support group in their included users filter.

Get-BrokerAccessPolicyRule -Enabled $true -IncludedUser sales\tech-support
<!--NeedCopy-->

Parameters

-Uid

Gets only the rule with the specified unique ID.

Type: Int32
Position: 2
Default value: None
Required: True
Accept pipeline input: False
Accept wildcard characters: False

-Name

Gets only rules with the specified name.

Type: String
Position: 2
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-AllowedConnections

Gets only rules that have the specified value in the AllowedConnections property of their included SmartAccess tags filter.

Valid values are Filtered, NotViaAG, ViaAG and AnyViaAG.

Type: AllowedConnection
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-AllowedUsers

Gets only rules that have the specified value in the AllowedUsers property of their included users filter.

Valid values are Filtered, AnyAuthenticated, Any, AnonymousOnly and FilteredOrAnonymous.

Type: AllowedUser
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Description

Gets only rules with the specified description.

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-DesktopGroupName

Gets only rules applying to desktop groups with names matching the specified name.

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-DesktopGroupUid

Gets only rules that apply to the desktop group with the specified unique ID.

Type: Int32
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Enabled

Gets only rules that are in the specified state, either enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ExcludedClientIPFilterEnabled

Gets only rules that have their excluded client IP address filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ExcludedClientName

Gets only rules that have the specified client name in their excluded client names filter (whether the filter is enabled or not).

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-ExcludedClientNameFilterEnabled

Gets only rules that have their excluded client name filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ExcludedSmartAccessFilterEnabled

Gets only rules that have their excluded SmartAccess tags filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ExcludedSmartAccessTag

Gets only rules that have the specified SmartAccess tag in their excluded SmartAccess tags filter (whether the filter is enabled or not).

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-ExcludedUser

Gets only rules that have the specified user in their excluded users filter (whether the filter is enabled or not).

Type: User
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ExcludedUserFilterEnabled

Gets only rules that have their excluded user filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-IncludedClientIPFilterEnabled

Gets only rules that have their included client IP address filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-IncludedClientName

Gets only rules that have the specified user device name in their included client names filter (whether the filter is enabled or not).

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-IncludedClientNameFilterEnabled

Gets only rules that have their included client name filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-IncludedSmartAccessFilterEnabled

Gets only rules that have their included SmartAccess tags filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-IncludedSmartAccessFilterType

Gets only rules that have the specified included SmartAccess tags filter type (MatchAll, or MatchAny).

Type: String
Accepted values: MatchAll, MatchAny
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-IncludedSmartAccessTag

Gets only rules that have the specified SmartAccess tag in their included SmartAccess tags filter (whether the filter is enabled or not).

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-IncludedUser

Gets only rules that have the specified user in their included users filter (whether the filter is enabled or not).

Type: User
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-IncludedUserFilterEnabled

Gets only rules that have their included user filter enabled ($true) or disabled ($false).

Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Metadata

Gets records with matching metadata entries.

The value being compared with is a concatenation of the key name, a colon, and the value. For example: -Metadata “abc:x*” matches records with a metadata entry having a key name of “abc” and a value starting with the letter “x”.

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ReturnTotalRecordCount

When specified, this causes the cmdlet to output an error record containing the number of records available. This error record is additional information and does not affect the objects written to the output pipeline. See about_Broker_Filtering for details.

Type: SwitchParameter
Position: Named
Default value: False
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-MaxRecordCount

Specifies the maximum number of records to return.

Type: Int32
Position: Named
Default value: 250
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Skip

Skips the specified number of records before returning results. Also reduces the count returned by -ReturnTotalRecordCount.

Type: Int32
Position: Named
Default value: 0
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-SortBy

Sorts the results by the specified list of properties. The list is a set of property names separated by commas, semi-colons, or spaces. Optionally, prefix each name with a + or - to indicate ascending or descending order. Ascending order is assumed if no prefix is present.

Type: String
Position: Named
Default value: The default sort order is by name or unique identifier.
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Filter

Gets records that match a PowerShell style filter expression. See about_Broker_Filtering for details.

Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-FilterScope

Gets only results allowed by the specified scope id.

Type: Guid
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-Property

Specifies the properties to be returned. This is similar to piping the output of the command through Select-Object, but the properties are filtered more efficiently at the server.

Type: String[]
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

CitrixCommonParameters

This cmdlet supports the common Citrix parameters: -AdminAddress, -AdminClientIP, -BearerToken, -TraceParent, -TraceState and -VirtualSiteId. For more information, see about_CitrixCommonParameters.

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

None

You cannot pipe input into this cmdlet.

Outputs

Citrix.Broker.Admin.SDK.AccessPolicyRule

Get-BrokerAccessPolicyRule returns all access policy rules that match the specified selection criteria.

Get-BrokerAccessPolicyRule