Set-BrokerAppEntitlementPolicyRule
Modifies an existing application rule in the site's entitlement policy.
Syntax
Set-BrokerAppEntitlementPolicyRule
[-InputObject] <AppEntitlementPolicyRule[]>
[-PassThru]
[-AddExcludedUsers <User[]>]
[-AddIncludedUsers <User[]>]
[-Description <String>]
[-Enabled <Boolean>]
[-ExcludedUserFilterEnabled <Boolean>]
[-ExcludedUsers <User[]>]
[-IncludedUserFilterEnabled <Boolean>]
[-IncludedUsers <User[]>]
[-LeasingBehavior <LeasingBehavior>]
[-RemoveExcludedUsers <User[]>]
[-RemoveIncludedUsers <User[]>]
[-SessionReconnection <SessionReconnection>]
[-LoggingId <Guid>]
[<CitrixCommonParameters>]
[<CommonParameters>]
Set-BrokerAppEntitlementPolicyRule
[-Name] <String>
[-PassThru]
[-AddExcludedUsers <User[]>]
[-AddIncludedUsers <User[]>]
[-Description <String>]
[-Enabled <Boolean>]
[-ExcludedUserFilterEnabled <Boolean>]
[-ExcludedUsers <User[]>]
[-IncludedUserFilterEnabled <Boolean>]
[-IncludedUsers <User[]>]
[-LeasingBehavior <LeasingBehavior>]
[-RemoveExcludedUsers <User[]>]
[-RemoveIncludedUsers <User[]>]
[-SessionReconnection <SessionReconnection>]
[-LoggingId <Guid>]
[<CitrixCommonParameters>]
[<CommonParameters>]
Description
The Set-BrokerAppEntitlementPolicyRule cmdlet modifies an existing application rule in the site's entitlement policy.
An application rule in the entitlement policy defines the users who are allowed per-session access to a machine to run one or more applications published from the rule's desktop group.
Changing a rule does not affect existing sessions launched using the rule, but if the change removes an entitlement to a machine that was previously granted, users may be unable to reconnect to a disconnected session on that machine.
Examples
EXAMPLE 1
Adds the user group OFFICE\contractors to those entitled to run applications from the rule's associated desktop group. This grants all members of that group an entitlement to an application session from that group.
Set-BrokerAppEntitlementPolicyRule 'Temp Workers' -AddIncludedUsers office\contractors
EXAMPLE 2
Disables the Temp Workers application rule in the entitlement policy. This prevents further application sessions being launched using this rule until it is re-enabled. However, access to existing application sessions is not affected.
Set-BrokerAppEntitlementPolicyRule 'Temp Workers' -Enabled $false
Parameters
-InputObject
The application rule in the entitlement policy to be modified.
| Type: | AppEntitlementPolicyRule[] |
| Position: | 2 |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True (ByValue) |
| Accept wildcard characters: | False |
-Name
The name of the application rule in the entitlement policy to be modified.
| Type: | String |
| Position: | 2 |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True (ByPropertyName) |
| Accept wildcard characters: | True |
-PassThru
This cmdlet does not generate any output, unless you use the PassThru parameter, in which case it returns the affected record.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-AddExcludedUsers
Adds the specified users to the excluded users filter of the rule, that is, the users and groups who are explicitly denied entitlements to run applications published from the desktop group.
See the ExcludedUsers parameter for more information.
| Type: | User[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-AddIncludedUsers
Adds the specified users to the included users filter of the rule, that is, the users and groups who are granted an entitlement to an application session by the rule.
See the IncludedUsers parameter for more information.
| Type: | User[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Description
Changes the description of the application rule. The text is purely informational for the administrator, it is never visible to the end user.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
| Disallowed characters: | All ASCII control characters |
-Enabled
Enables or disables the application rule. A disabled rule is ignored when evaluating the site's entitlement policy.
| Type: | Boolean |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ExcludedUserFilterEnabled
Enables or disables the excluded users filter. If the filter is disabled then any user entries in the filter are ignored when entitlement policy rules are evaluated.
| Type: | Boolean |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ExcludedUsers
Changes the excluded users filter of the rule, that is, the users and groups who are explicitly denied entitlements to run applications published from the desktop group.
This can be used to exclude users or groups or users who would otherwise gain access by groups specified in the included users filter.
| Type: | User[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-IncludedUserFilterEnabled
Enables or disables the included users filter. If the filter is disabled then any user who satisfies the requirements of the access policy is implicitly granted an entitlement to an application session by the application rule.
Users who would be implicitly granted access when the filter is disabled can still be explicitly denied access using the excluded users filter.
| Type: | Boolean |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-IncludedUsers
Changes the included users filter of the rule, that is, the users and groups who are granted an entitlement to an application session by the rule.
If a user appears explicitly in the excluded users filter of the rule or is a member of a group that appears in the excluded users filter, no entitlement is granted whether or not the user appears in the included users filter.
| Type: | User[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-LeasingBehavior
Defines the desired connection leasing behavior applied to sessions launched using this entitlement. Possible values are:
Allowed and Disallowed.
The Allowed value indicates that connection leasing should behave normally. The Disallowed value prevents users
from launching or reconnecting to sessions using this entitlement while connection leasing is active (typically during a database outage).
| Type: | LeasingBehavior |
| Accepted values: | Allowed, Disallowed |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-RemoveExcludedUsers
Removes the specified users from the excluded users filter of the application rule, that is, the users and groups who are explicitly denied entitlements to run applications published from the desktop group.
See the ExcludedUsers parameter for more information.
| Type: | User[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-RemoveIncludedUsers
Removes the specified users from the included users filter of the rule, that is, the users and groups who are granted an entitlement to an application session by the rule.
See the IncludedUsers parameter for more information.
| Type: | User[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-SessionReconnection
Defines reconnection (roaming) behavior for sessions launched using this rule. Possible values are:
Always, DisconnectedOnly, and SameEndpointOnly.
| Type: | SessionReconnection |
| Accepted values: | Always, DisconnectedOnly, SameEndpointOnly |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-LoggingId
Specifies the identifier of the high level operation that this cmdlet call forms a part of. Desktop Studio and Desktop Director typically create High Level Operations. PowerShell scripts can also wrap a series of cmdlet calls in a High Level Operation by way of the Start-LogHighLevelOperation and Stop-LogHighLevelOperation cmdlets.
| Type: | Guid |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
CitrixCommonParameters
This cmdlet supports the common Citrix parameters: -AdminAddress, -AdminClientIP, -BearerToken, -TraceParent, -TraceState and -VirtualSiteId. For more information, see about_CitrixCommonParameters.
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Inputs
Citrix.Broker.Admin.SDK.AppEntitlementPolicyRule
The application rule in the entitlement policy rule to be modified.
Outputs
None or Citrix.Broker.Admin.SDK.AppEntitlementPolicyRule
This cmdlet does not generate any output, unless you use the PassThru parameter, in which case it generates a Citrix.Broker.Admin.SDK.AppEntitlementPolicyRule object.