<#
    Prereqs:
    User logged on to domainjoined pc.
    Powershell remoting enabled on controller - default on 2012 or later
    Service account with permissions to lookup and end session in the Site

    Script outputs a list of applications that the user had running to a CSV file on the controller - c:\temp\logoff-log.csv.

    To protect the password of the serviceaccount it would be wise to wrap this into an EXE file.
    Place the EXE file on the users desktop og start menu, and they can now stop their sessions.

    Be aware that the EXE can be reverse engineered - so limit what the service account has access to do.
#>

$DeliveryGroupsToSearch = "Deliverygroup_production"
$UsernameToLogoff = $env:USERNAME
$UserDomain = "domain.local"
$Controller = "Controller01.domain.local"
$ControllerUsername = "svc_Xen_logoff"
$ControllerPassword = "SuperSecretPassword" | ConvertTo-SecureString -asPlainText -Force

$Credential = New-Object System.Management.Automation.PSCredential($ControllerUsername, $controllerPassword)

Invoke-Command -ComputerName $Controller -Credential $Credential -ScriptBlock {
	param ($DeliveryGroupsToSearch,
		$UsernameToLogoff,
		$UserDomain
	)
	Add-PSSnapin Citrix.Broker.Admin.V2
	$ApplicationList = (Get-BrokerSession -Username "$UserDomain\$UsernameToLogoff" -DesktopGroupName $DeliveryGroupsToSearch | Select-Object -ExpandProperty ApplicationsInUse) -join ';'
	Get-BrokerSession -Username "$UserDomain\$UsernameToLogoff" -DesktopGroupName $DeliveryGroupsToSearch | Stop-BrokerSession
	Add-Content -Path C:\Temp\Logoff-log.csv -Value "$(Get-Date),$UsernameToLogoff,$ApplicationList"
} -ArgumentList $DeliveryGroupsToSearch, $UsernameToLogoff, $UserDomain