ops@toolbox:~$ Get-Command -Module Citrix.*

Citrix Reference

Citrix CVAD (Virtual Apps & Desktops) PowerShell and Citrix ADC (NetScaler) CLI: searchable, copy-ready commands for everyday admin tasks.

Run on a Delivery Controller with Citrix snap-ins, or from a remote machine with the CVAD SDK installed. Use Add-PSSnapin Citrix.* to load snap-ins in on-prem environments.

🔧 Setup

Add-PSSnapin Citrix.*Load all Citrix CVAD snap-ins (on-prem DDC)
Get-PSSnapin | Where-Object {$_.Name -like 'Citrix*'}List loaded Citrix snap-ins
Get-BrokerSiteVerify connection to Delivery Controller and show site info
Set-XDCredentials -CustomerId "myorg" -ProfileType CloudApi -StoreAs DefaultAuthenticate to Citrix DaaS (Cloud)

👤 Sessions

Get-BrokerSession | Select UserName, MachineName, SessionState, Protocol | Sort UserNameAll sessions, user, machine, state and protocol (ICA/RDP)
(Get-BrokerSession | Where-Object {$_.SessionState -eq 'Active'}).CountCount of active sessions
Get-BrokerSession | Where-Object {$_.SessionState -eq 'Disconnected'} | Select UserName, MachineName, SessionStateChangeTimeDisconnected sessions with time since disconnect
Get-BrokerSession -UserName "DOMAIN\jsmith"Find all sessions for a specific user
Get-BrokerSession -UserName "DOMAIN\jsmith" | Stop-BrokerSessionLog off a user's sessions
Get-BrokerSession | Group-Object SessionState | Select Name, CountSession count by state (Active, Disconnected, etc.)

🖥 Machines / VDAs

Get-BrokerMachine | Select DNSName, RegistrationState, SessionCount, PowerState | Sort DNSNameAll machines with registration and power state
Get-BrokerMachine | Where-Object {$_.RegistrationState -ne 'Registered'} | Select DNSName, RegistrationStateFind all unregistered VDAs
Get-BrokerMachine -DNSName "vda01.domain.com" | Set-BrokerMachineMaintenanceMode -MaintenanceMode $truePut a machine in maintenance mode
Get-BrokerMachine -MaintenanceMode $true | Select DNSName, DeliveryGroupList machines in maintenance mode
New-BrokerHostingPowerAction -MachineName "DOMAIN\vda01" -Action RestartRestart a machine via power action
Get-BrokerMachine | Group-Object RegistrationState | Select Name, CountMachine count by registration state

📂 Delivery Groups & Catalogs

Get-BrokerDesktopGroup | Select Name, Enabled, TotalDesktops, DesktopsAvailable, DesktopsInUseDelivery group capacity summary
Get-BrokerCatalog | Select Name, ProvisioningType, AllocationType, MachinesCountMachine catalog summary
Get-BrokerApplication | Select Name, ApplicationType, Enabled | Sort NamePublished applications list
Get-BrokerDesktopGroup -Name "Finance Desktops" | Set-BrokerDesktopGroup -Enabled $falseDisable a delivery group

SSH to the ADC management IP (NSIP) and run these commands. Always run save ns config after changes, the running config is in-memory only until saved.

📋 System Info & Save

show versionADC firmware version and build number
show ns ipAll IP addresses (NSIP, SNIPs, VIPs)
show ns hardwareHardware model, serial number, CPU
show ha nodeHA pair status and synchronisation state
show ns licenseLicensed features (SSL Offload, LB, Gateway…)
show ns runningConfigFull running configuration
save ns config💾 Save config to flash: ALWAYS do this after changes

⚖ Load Balancing

show lb vserverAll LB virtual servers and their UP/DOWN state
show lb vserver MY_LB_VSDetail for a specific LB vserver
show servicegroup MY_SGService group members and health state
show service MY_SVCIndividual service status and stats
enable server MY_SERVEREnable a backend server (bring it back into service)
disable server MY_SERVERDisable a backend server (graceful drain for maintenance)
stat lb vserver MY_LB_VSLive traffic stats, requests/s, connections, hits

🔀 Content Switching

show cs vserverAll content switching virtual servers
show cs policyContent switching policies and expressions
show cs actionCS actions (which LB vserver to target)

🔒 SSL Certificates

show ssl certkeyAll installed certificates with expiry dates
show ssl vserver MY_LB_VSSSL config for a vserver, ciphers and cert binding
add ssl certkey MYCERT -cert /nsconfig/ssl/mycert.pem -key /nsconfig/ssl/mykey.pemInstall a new certificate
update ssl certkey MYCERT -cert /nsconfig/ssl/newcert.pem -key /nsconfig/ssl/newkey.pemUpdate (renew) an existing certificate key-pair
show ssl certkey | grep "Days to expire"Quickly find certificates near expiry
bind ssl vserver MY_LB_VS -certkeyName MYCERTBind a certificate to a vserver

🌐 Citrix Gateway (Access/VPN)

show vpn vserverCitrix Gateway virtual servers
show vpn sessionpolicySession policies (ICA proxy, SmartAccess, full VPN)
show aaa sessionActive authenticated gateway sessions
kill aaa session -userName jsmithTerminate a specific user's gateway session

🔍 VDA Registration Issues

Get-BrokerMachine | Where-Object {$_.RegistrationState -ne 'Registered'} | Select DNSName, RegistrationState, LastDeregistrationReasonUnregistered VDAs with the last deregistration reason
Get-EventLog -LogName Application -Source Citrix* -Newest 50 -ComputerName vda01Citrix Application events on a specific VDA
Test-NetConnection -ComputerName ddc01.domain.com -Port 80Test VDA → DDC port 80 connectivity
Test-NetConnection -ComputerName ddc01.domain.com -Port 443Test VDA → DDC port 443 connectivity
Get-Service -Name 'BrokerAgent' -ComputerName vda01 | Restart-ServiceRestart Citrix Broker Agent service on a VDA
Get-Service -Name 'picaSvc2','BrokerAgent','CitrixTelemetryService' -ComputerName vda01 | Select Name, StatusCheck key Citrix services on a VDA

📊 Health Checks

Get-BrokerController | Select DNSName, State, ActiveSiteServicesDelivery Controller status
Test-BrokerDBConnection -DBConnection (Get-BrokerDBConnection)Test database connectivity from DDC
Get-BrokerMachine | Group-Object RegistrationState | Select Name, CountMachine count by registration state
Get-BrokerDesktopGroup | Select Name, TotalDesktops, DesktopsAvailable, DesktopsDisconnected, DesktopsInUseDelivery group capacity at a glance

🔧 ADC Troubleshooting

show ns eventsRecent system events and alerts
show audit messagesAdmin audit trail, who changed what and when
show monitor MY_MONITORHealth monitor status and recent probe results
start nstrace -size 0 -mode TCPDUMP -filter "PORT 443"Start packet capture on port 443
stop nstraceStop capture, saved to /var/nslog/
ping 10.0.0.1 -S 10.0.0.5Ping from a specific source IP (e.g. a SNIP)

CVAD on-prem vs Citrix DaaS (Cloud)

Citrix CVAD (Virtual Apps and Desktops) is the on-premises product with Delivery Controllers running on Windows Server. Citrix DaaS is the cloud-hosted management plane where DDCs are managed by Citrix. On-prem uses Add-PSSnapin Citrix.* on a DDC; DaaS uses the Citrix DaaS PowerShell SDK which authenticates via OAuth to citrix.cloud.com. Most cmdlet names are identical between the two, but connection setup differs.

Key port flows to understand

Understanding these flows is essential when troubleshooting firewall blocks between client launches and VDA sessions.

Always save the ADC config

Changes to the Citrix ADC running config are in-memory only. A reboot without save ns config loses all changes. On HA pairs, saving on the primary node also propagates to the secondary, but only after the save command is run on the primary node.

Related tools

VMware ESXi Reference
esxcli, PowerCLI and govc commands for vSphere.
Hyper-V Reference
PowerShell Hyper-V cmdlets: VMs, checkpoints, networking.
TLS Cipher Reference
Cipher suite grades for ADC SSL profile hardening.