Get-BrokerResource

Last published : Oct 31, 2026
Gets resources that a user can broker connections to.
Related information
about_Broker_AccessPolicy

Syntax

Get-BrokerResource
   [-User] <String>
   [-Groups <String[]>]
   [-TenantId <Guid>]
   [-ClientName <String>]
   [-ClientIP <String>]
   [-ViaAG <Boolean>]
   [-SmartAccessTags <String[]>]
   [-AppProtectionCapable <Boolean>]
   [<CitrixCommonParameters>]
   [<CommonParameters>]

Description

Retrieve a list of resources that a user has access to, taking into account the site access policy, configuration of desktop groups, assignments, entitlements, and applications.
What a user has access to depends on a number of attributes:
  • User's name or security identifier.
  • Groups that the user is a member of (names or security identifiers).
  • IP address of the client the user connects from.
  • Name of the client that the user connects from.
  • Whether the user is connecting via Citrix Access Gateway.
  • SmartAccess tags when connecting via Citrix Access Gateway.
You must always specify the user's name or security identifier, but you will not always be able to predict what some of the other values will be. By omitting these values the corresponding access checks are ignored.
Consider for example, a site configuration that uses IP address ranges to allow access to private desktop A when connecting from the local network and private desktop B when connecting from home. Running this cmdlet without specifying a client IP address would return both A and B.
The output of this cmdlet depends on the available resources:
  • Assigned private desktops are returned as PrivateDesktop objects.
  • Shared desktops are returned as EntitlementPolicyRule objects.
  • Assign-On-First-Use desktops that have not been assigned yet are
    returned as AssignmentPolicyRule objects.
  • Application resources produce Application objects.
If more than one type of resource is available, the output pipeline contains a mixture of the above objects, in no particular order.
Only resources accessible based on the specified parameters, and visible to the administrator running this cmdlet are returned.

Examples

EXAMPLE 1

List resources visible by User1 assuming membership of a couple of groups.
Get-BrokerResource -User MYDOMAIN\User1 -Groups MYDOMAIN\Accounts,MYDOMAIN\Managers

EXAMPLE 2

Get all of the desktop groups supporting the resources accessible by User1, outputting the uid and name of each desktop group.
[int[]]$groups = (Get-BrokerResource -User MYDOMAIN\User1 | %{ $_.DesktopGroupUid })
Get-BrokerDesktopGroup -Filter { Uid -in $groups } -Property Uid,Name

Parameters

-User

Gets resources given the specified user name or security identifier.
Type: String
Position: 2
Default value: None
Required: True
Accept pipeline input: False
Accept wildcard characters: True

-Groups

Get resources accessible given a list of group names or security identifiers.
Type: String[]
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-TenantId

Specifies identity of tenant associated with the user and groups. Can only be used in multitenant sites.
Type: Guid
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-ClientName

Get resources given the specified client name.
Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-ClientIP

Get resources given the specified client IP address.
Type: String
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: True

-ViaAG

Gets resources given the specified ViaAG setting.
Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-SmartAccessTags

Get resources given the specified SmartAccess tags.
Type: String[]
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

-AppProtectionCapable

Get Resources given the specified app protection capability of the client.
Type: Boolean
Position: Named
Default value: None
Required: False
Accept pipeline input: False
Accept wildcard characters: False

CitrixCommonParameters

This cmdlet supports the common Citrix parameters: -AdminAddress, -AdminClientIP, -BearerToken, -TraceParent, -TraceState and -VirtualSiteId. For more information, see about_CitrixCommonParameters.

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

None

You cannot pipe input into this cmdlet.

Outputs

Citrix.Broker.Admin.SDK.Application

Get-BrokerResource returns an Application object for each accessible application.

Citrix.Broker.Admin.SDK.AssignmentPolicyRule

Get-BrokerResource returns an AssignmentPolicyRule object for each accessible Assign-On-First-Use desktop.

Citrix.Broker.Admin.SDK.EntitlementPolicyRule

Get-BrokerResource returns an EntitlementPolicyRule object for each accessible entitlement to a shared desktop.

Citrix.Broker.Admin.SDK.PrivateDesktop

Get-BrokerResource returns a PrivateDesktop for each accessible assigned private desktop.