Sometimes you need to find a user’s VDI machine to work on it. This function will do that for you. I typically use the last name as the search to limit the scope of the machines found. It will find all machines that contain any part of the string you enter. It also shows the MachineName which includes the domain\machinename to help locate the user machine. You can add other parameters such as AgentVersion if desired. I limited the scope to not include floating pool (Random) assigned machines. For a list of all fields of Get-BrokerMachine that can be selected in the function with Select-Object, please see this link: Get-BrokerMachine Options
*Update. Changes made due to API only allowing 100 licenses to be released at one time.*
Building on getting the licenses on the last post, how about a way to release them? Obviously you will need to follow the guidelines laid out by Citrix EULA on when you can release licenses: Citrix License Usage.
You do have the option to use the console in Citrix Cloud, but if you prefer to do things via script, you can do that as well!
Important note to make…. The format of the consumerList is what presented the biggest issue. With a bit of assistance from a teammate, it was possible to get the proper way to format the data.
You’ll notice the consumerList = @() in there. It is expecting to have an array of consumerList be passed to it. If you do not format this way, you will get invalid character errors.
Example of format that will fail all so miserably and give you that wonderful invalid character error:
This is an example of the output that will work and prevent frustration:
Example with five of users:
Example of result of successful release of 5 users:
# Script to release licenses from Citrix Cloud. Tested with PowerShell ISE. Also requires secure-client.csv with ID, Secret, and CustomerID in CSV to pass to Citrix Cloud.
# This must be used in accordance with Citrix EULA for users not having accessed in 30+ day period. Example below is targeting where users that have not logged in over 60 days.
# This will report on what users are in that group over 60 days. You can do a quick check using $releaseUsers.count before doing the release to see how many licenses will be released.
# ALWAYS check the exported report of users before releasing to make sure you are releasing the licenses you are expecting to.
$date = (Get-Date).AddDays(-60)
$creds = Import-Csv "c:\scripts\secure-client.csv"
$CLIENT_ID = $creds.ID
$CLIENT_SECRET = $creds.Secret
$CUSTOMER_ID = $creds.CustomerID
$tokenUrl = 'https://api-us.cloud.com/cctrustoauth2/root/tokens/clients'
$reportName = "user-license-toRelease.csv"
$getDate = Get-Date -Format MMddyyyy
$reportLocation = "C:\scripts\logs"
$response = Invoke-WebRequest $tokenUrl -Method POST -Body @{
grant_type = "client_credentials"
client_id = $CLIENT_ID
client_secret = $CLIENT_SECRET
}
$token = $response.Content | ConvertFrom-Json
$headers = @{
Accept = "application/json"
Authorization = "CwsAuth Bearer=$($token.access_token)"
'Citrix-CustomerId' = $CUSTOMER_ID
}
$resourceLocUrl = "https://api-us.cloud.com/catalogservice/$CUSTOMER_ID/sites"
$response = Invoke-WebRequest $resourceLocUrl -Headers $headers
$content = $response.Content | ConvertFrom-Json
$siteID = $content.sites.id
$headers = @{
Accept = "application/json"
Authorization = "CwsAuth Bearer=$($token.access_token)"
'Citrix-CustomerId' = $CUSTOMER_ID
'Citrix-InstanceId' = $siteID
}
$consumerList = Invoke-RestMethod "https://api-us.cloud.com/licensing/license/enterprise/cloud/cvad/ud/users" -Method GET -Headers $headers | Select-Object consumerList -ExpandProperty consumerList -ExcludeProperty consumerList
$releaseUsers = $consumerList | Where-Object {[DateTime]$_.latestLogonTime -lt $date}
$releaseUsers | Export-Csv "$reportLocation\$getDate-$reportName" -Append -NoTypeInformation
if($releaseUsers.count -gt 100){
$smallerCounter = $releaseUsers.Count
$toSkip = 0
Do{
$smallerList = $releaseUsers | Select-Object -Skip $toSkip -first 100
$body = @{
productEdition = "XAXDFull"
licenseType = "user"
consumerList = @(
$smallerList.consumerId
)
} | ConvertTo-Json
Invoke-RestMethod "https://api-us.cloud.com/licensing/license/enterprise/cloud/cvad/ud/licenserelease" -Method POST -Body $body -Headers $headers -ContentType 'application/json'
$toSkip += 100
$smallerCounter -= 100
} Until ($smallerCounter -lt 100)
$smallerList = $releaseUsers | Select-Object -Skip $toSkip -first $smallerCounter
$body = @{
productEdition = "XAXDFull"
licenseType = "user"
consumerList = @(
$smallerList.consumerId
)
} | ConvertTo-Json
Invoke-RestMethod "https://api-us.cloud.com/licensing/license/enterprise/cloud/cvad/ud/licenserelease" -Method POST -Body $body -Headers $headers -ContentType 'application/json'
}
So you want to find out what licenses are in use? Maybe you want to know licenses that are checked out that might be over 30 days since that user logged in. Maybe you want to know for longer periods of time. You can get this from the Citrix Cloud console. You can also get it another way. And you can filter down to based on if it has been a period of time since the user accessed. This example gets all users then filters down to the latestLogonTime of older than 30 days.
# Script to get license use from Citrix Cloud. Tested with Powershell ISE. Also requires secure-client.csv with ID, Secret, and CustomerID in CSV to pass to Citrix Cloud.
# This creates a csv with the consumerID, deviceCount, consumerDisplayName, latestLogonTime, and firstLogonTime.
<# All fields available:
consumerId : user@company.com
consumerDisplayName : user
deviceCount : 0
userId : user@company.com
upn : user@company.com
userName : user
domain : domain
latestLogonTime : UTC Time
firstLogonTime : UTC Time
#>
$date = Get-Date
$olderThan = $date.AddDays(-30)
$creds = Import-Csv "c:\scripts\secure-client.csv"
$CLIENT_ID = $creds.ID
$CLIENT_SECRET = $creds.Secret
$CUSTOMER_ID = $creds.CustomerID
$tokenUrl = 'https://api-us.cloud.com/cctrustoauth2/root/tokens/clients'
$reportName = "user-license-use.csv"
$getDate = Get-Date -Format MMddyyyy
$reportLocation = "C:\scripts\logs"
$output = @()
$searchOutput = @()
$response = Invoke-WebRequest $tokenUrl -Method POST -Body @{
grant_type = "client_credentials"
client_id = $CLIENT_ID
client_secret = $CLIENT_SECRET
}
$token = $response.Content | ConvertFrom-Json
$headers = @{
Accept = "application/json"
Authorization = "CwsAuth Bearer=$($token.access_token)"
'Citrix-CustomerId' = $CUSTOMER_ID
}
$resourceLocUrl = "https://api-us.cloud.com/catalogservice/$CUSTOMER_ID/sites"
$response = Invoke-WebRequest $resourceLocUrl -Headers $headers
$content = $response.Content | ConvertFrom-Json
$siteID = $content.sites.id
$headers = @{
Accept = "application/json"
Authorization = "CwsAuth Bearer=$($token.access_token)"
'Citrix-CustomerId' = $CUSTOMER_ID
'Citrix-InstanceId' = $siteID
}
$response = Invoke-RestMethod "https://api-us.cloud.com/licensing/license/enterprise/cloud/cvad/ud/users" -Method 'GET' -Headers $headers
$output = $response.consumerList
foreach($out in $output){
$line = "" | Select-Object consumerId, deviceCount, consumerDisplayName, latestLogonTime, firstLogonTime
$line.consumerId = $out.consumerId
$line.deviceCount = $out.deviceCount
$line.consumerDisplayName = $out.consumerDisplayName
$line.latestLogonTime = ([DateTime]$out.latestLogonTime)
$line.firstLogonTime = ([DateTime]$out.firstLogonTime)
$searchOutput += $line
}
$searchOutput | Where-Object latestLogonTime -lt $olderThan| Export-Csv "$reportLocation\$getDate-$reportName" -Append -NoTypeInformation
Looks like there have been some updates to the Activity Manager on the Citrix Cloud Director. Buttons have been moved. Layout appears different. The contact card in the upper-left appears now on the Activity Manager and Details page. The overall feel of this is really nice and feels sleeker.
The Details pane appears to have remained the same.
So you have a new / different vCenter you want to move your VDI machines to. For the power management part, you will need to have the other hypervisor connection configured. You can run the script below to change the hypervisor connection on your VDI machines. You will want to make sure you have the VMs powered down before beginning. The first steps are just information gathering. This is part of migrating machines to new hardware. I will be adding the other pieces at a later date.
First you will need to get your hypervisor names and Uids with this command: Get-BrokerHypervisorConnection | Select-Object Name, HypHypervisorType, Uid.
Then you can get a list of machines with the hypervisor connection you want to change from. This was just getting the first machine that had the hypervisor I wanted to change from. Machine was already moved to a new Uid but it would be 2 in this case. Get-BrokerMachine -MaxRecordCount 100000 | Where-Object SessionSupport -eq “SingleSession” | Where-Object HypervisorConnectionUid -eq “3” | Select-Object -first 1 | Select-Object HostedMachineName, HypervisorConnectionName, HypervisorConnectionUid
<# Script to change Hypervisor connection and power systems back up. This was done with PowerShell ISE 5.1, default profile configured on CitrixCloud SDK, and ESXi 7.0 with connection
to vCenter. This was built from Ben McGirt and slightly modified to get the machine names with a specific configured HypervisorConnection via Get-BrokerMachine command.
As it is best to change these settings and power the VM on, you will need to have the VMs powered down before beginning. The Uid in the example is "2" to get the machines using a different
HypvisorConnectionUid that you wish to change from and setting in this example to HypervisorConnectionUid "3."
#>
Get-XDAuthentication -ProfileName "default"
$getVDIMachines = Get-BrokerMachine -MaxRecordCount 100000 | Where-Object SessionSupport -eq "SingleSession" | Where-Object HypervisorConnectionUid -eq "2" | Select-Object HostedMachineName, HypervisorConnectionName, HypervisorConnectionUid
$citrixVMs = $getVDIMachines.HostedMachineName
Function PowerOnVM ([string] $Name) #, [string] $Hostname)
#From https://thecloudxpert.net/2016/04/25/howto-power-on-a-vmware-virtual-machine-with-powercli-powercli-101/
{
$VM = Get-VM -Name $Name
Switch ($VM.PowerState)
{
PoweredOn { Write-Host "$VM already Powered On.";break}
PoweredOff { Write-Host "Powering on $VM"; Start-VM -VM $VM;break}
Suspended { Write-Host "$VM suspended.";break}
Default {break}
}
}
ForEach ($VM in $CitrixVMs){
Set-BrokerMachine -MachineName ("*\" + $VM) -HypervisorConnectionUid 3
Start-Sleep -Seconds 2
PowerOnVM $VM
}
You know you have a LOT of apps. But you want to know about 1 app in particular. You could go to Studio and look. You could peruse the various pieces and parts to and get what you want. Or…. you could just grab it via script. So that is what we gonna do here. We are going to present a grid view of the applications you have published, select one of them, and give you all the information you have room for! And, for an unlimited time offer, export to csv! This requires having setup your Citrix Cloud authentication and using your secureclient.csv to access.
Fourth in the series of moving the control plane to Citrix Cloud…. So you have moved your control plane and now you need some monitoring via the wonders of Director. You can do this… There are some things that you have to consider. First, historical data DOES NOT migrate as part of using the Automated Configuration Tool (ACT). I looked over the list of things that it did, and that was not one of the things listed as migrating. I did learn through a ticket that moving the historical data is not at this time supported, nor was there a tool to move said data. For those customers that heavily rely on the reporting data available, you will need to plan accordingly. This presents a difficulty that an on-prem version of Director would need to be maintained for a year (or whatever grooming schedule you have defined) to allow the data to be accessed while the new data was populating. This can cause issues with people needing to access BOTH locations in order to get accurate data. Also, default for Premium / Platinum customers is 90 days of historical data in Director. Advanced licensing provides 31 days. If you need more time than that, you will need to open a ticket with Citrix to get that time extended which can take 1 – 2 weeks. (More information on Citrix Director in Cloud can be found here: Director On Citrix Cloud )
Now if you have setup AD Connect to connect to Citrix Cloud with company credentials, you can publish Director with the accounts people already use to login with at their company. After moving, there is also a post that will come about how scopes are affected and you have to reassign your access groups used in your company to the new Monitor role that is created for EACH scope they need access.
To confirm that you have AD Connect configured, you can check the Identity And Access Management on the hamburger menu on your Citrix Cloud login.
It should show Azure Active Directory and next to https://citrix.cloud.com/go should be your company name selected when you connected AAD.
If this is showing as connected, you can publish Director to your helpdesk group.
These are the arguments for publishing Director with Microsoft Edge:
Third in the series of moving the control plane to Citrix Cloud…. So you had your daily user report kicking out everyday (Surely you created one from this other post: https://xenapplepie.com/2022/04/12/if-you-could-get-those-user-counts-today-that-would-be-great/). It was working its happy way through life. Then you just moved parts it talked to into the cloud. I have created this updated report script to allow for it to pull from Citrix Cloud. This requires that you have already setup your API access with the secureclient.csv, that you added the CustomerID to your secureclient.csv, and you have installed the Citrix Cloud SDK. If you don’t have those, you are gonna have a bad day. I left the comment for the #Get Licensing Info so you can see what all other fields you can get if needed from there. If you are using VS Code, when you run that section, you can create a new variable and assign it as “$content.” and it will show the other available pieces of information you can assign such as “deviceLicenseUsage.”
**Update: Removed line with Get-XDAuthentication as it is doing a double authentication. Changed SDK commands to use $headers.Authorization to pass same bearer token**
Example Of Autocomplete From VS Code For LicensingSample Output From Script Email
Next in the series of Cloud Migration…. When migrating the control plane to Citrix Cloud, I found that if you had changed the PublishedName to something other than the default Delivery Group name, they up and vanished and reverted to the Delivery Group name. I didn’t have that many to have to change, but if you had a LOT of them set, it would have not been fun. But…. Powershell again to the rescue!
If you do use custom set PublishedName, then you will need to get a list exported from your old DDC to import. This builds on the other post of setting up your new Powershell SDK.
The script below has parts to run on the old DDC and on a machine with the new SDK installed.
# Script to get custom PublishedName and change from on-prem to Citrix Cloud after ACT import.
# To be ran on old on-prem DDC to get custom PublishedNames.
Get-BrokerDesktopGroup | Select-Object Name, PublishedName | Export-csv C:\scripts\logs\pubslishedname.csv -append -NoTypeInformation
# To be ran on machine with Citrix Cloud SDK installed.
asnp Citrix*
Get-XDCredentials -ProfileName "default"
$pubName = import-csv "C:\scripts\logs\published.csv"
foreach($pub in $pubName){
Get-BrokerDesktopGroup -Name $pub.Name | Set-BrokerDesktopGroup -PublishedName $pub.PublishedName
}
Get-BrokerDesktopGroup -MaxRecordCount 10000 | Select-Object Name, PublishedName
This is the output you see where the Name and PublishedName are matching the Delivery Group name.
After exporting your CSV from the old DDC and copying the file to your machine with the new SDK installed, you can edit the csv (example here in Notepad++) and make and changes you need to make to it.
After running the second part of the script, you see the changes reflected on the PublishedName field.
One of the other things you will have to do, is create an API access account that will download a secureclient.csv that you will use to authenticate and allow you to run commands against Citrix Cloud.
Logon to the Citrix Cloud at cloud.com and get authenticated.
Click on the hamburger menu in the upper left.
Click on “Identity and Access Management.”
Click on “API Access.”
Fill out the name and click “Create Client.”
Copy and save the “ID” and “Secret.”
Click to download and save the “secureclient.csv” file to store in a safe location.
I added the “CustomerId” field to my secureclient file to pass to the XDCredential setup. To get this, you can see your CCID on the upper-right hand side underneath your name while you are logged into Citrix Cloud.
Below is what I used to configure my access to do the connections. One thing I noticed, if you name the profile anything other than “default,” it prompts for authentication and caused issues for automated scheduled tasks.
# Script to setup Citrix Cloud credential profile
asnp Citrix*
$secureClientProd = “C:\scripts\logs\secureclient-1.csv"
$secureClientTest = “C:\scripts\logs\secureclient-2.csv"
$xdCredsProd = import-csv $secureClientProd
$xdCredsTest = import-csv $secureClientTest
# Set prod profile
Set-XDCredentials -CustomerId $xdCredsProd.CustomerId -SecureClientFile $secureClientProd -ProfileType CloudAPI –StoreAs "default"
# Set test profile if you have a test cloud account
Set-XDCredentials -CustomerId $xdCredsTest.CustomerId -SecureClientFile $secureClientTest -ProfileType CloudAPI –StoreAs "Cloud-Test"
# List profiles
Get-XDCredentials -ListProfile
# Load credentials
Get-XDCredentials -ProfileName "default"
# To change profile credentials
Get-XDAuthentication -ProfileName "Cloud-Test"
# Clear Cloud credentials if you wish to delete a profile
Clear-XDCredentials -ProfileName "profilename"
So what I did to modify most of the scripts I was using before, was to remove the -AdminAddress and add these lines to the top of the scripts, then proceed business as normal. This allowed me to do the same things I was doing before and pass the API securecred file information.
