Powershell - Item Level Permission by Content Type

Question

Here is the scenario. I only need to run this once as business team just decided their contents are confidential. User Group is "Marketing", will use OOTB "Contribute" and all of marketing items are using "2011 Marketing" content type. The library name is "2011Sales". I need to take out current permissions (also remove inheritance) and only add "Marketing" group with "Contribute" right.

Updated Working Code:

$webUrl = "http://inside.national.com/Sales"
$web = Get-SPWeb $webUrl
$list = $web.Lists["2011Sales"]
$ct = "2011 Marketing"
$spgroup = "Custom SP Group"
$rd="Contribute"

foreach ($item in $list.items) {
    If ($item.ContentType.Name -eq $ct)
     {  
        $item.ResetRoleInheritance() # Not sure if this line is needed
        $item.BreakRoleInheritance($false) # I tried $true but did not work, so leave it at $false
        $item.SystemUpdate() # update without changing the modification date

        $group = $web.AllUsers[$spgroup]
        $roledef = $web.RoleDefinitions[$rd]
        $roleass = New-Object Microsoft.SharePoint.SPRoleAssignment($web.SiteGroups[$spgroup])
        $roleass.RoleDefinitionBindings.Add($roledef)
        $item.RoleAssignments.Add($roleass)
        $item.SystemUpdate() # update without changing the modified date
        Write-Host $item.Name " permission applied"
     }
}
$web.dispose()

Answer 1

After breaking the inheritance of an item (item,list,web) you have to call update() on that object to make sure the settings are saved to the database. Once these are saved you can start adding/changing the permissions for that item.

BreakRoleInheritance(false) will not copy the permissions of the parent to the new permissionset, supplying true will copy the permissions.

Updates (see also Vedran Rasols answer)

• Using foreach(item in list.items) is not recommended, use an SPQuery to select the items and properties you really want, otherwise you will fetch all data from the DB. See also this MSDN Best Practices Article!
• In theory you shouldn't have to call update(), but in some strange way in helped solving this issue.

bonus: Note that when breaking inheritance on lists the AllowUnsafeUpdate property of the parent web reverts to false, which can be annoying.

Answer 2

You need to take advantage of SPQuery class. Using CAML query is much, much, much more faster then doing foreach.

Here is script you 'really' want:

$webUrl = "http://inside.national.com/Sales"
$listName = "2011Sales"
$ctname = "2011Sales"
$groupname = "Custom SP Group"

# Get web and list
$web = Get-SPWeb -Identity $webUrl
$list = $web.Lists[$listName]

# Build CAML query
$caml="<Where><Eq><FieldRef Name='ContentType'/><Value Type='Text'>{0}</Value></Eq></Where>" -f $ctname
$query = New-Object Microsoft.SharePoint.SPQuery
$query.Query = $caml
# Set scope to Recursive to include all items from folders and Document Sets
$query.ViewAttributes = "Scope='Recursive'"
# Get our data (only items with proper ct name)
$items = $list.GetItems($query)

# Set Role Assignment
$spGroup = $web.SiteGroups[$groupname]
$spRoleAssignment = New-Object Microsoft.SharePoint.SPRoleAssignment($spGroup)
$sproledefinition = $web.RoleDefinitions["Contribute"]
$sproleassignment.RoleDefinitionBindings.Add($sproledefinition)

foreach ($item in $items) {
    # This is the fastest way of deleting all permissions
    # First you restore inheritance
    # And then you break it
    $item.ResetRoleInheritance()
    $item.BreakRoleInheritance($false)

    # Add new permission
    $item.RoleAssignments.Add($spRoleAssignment)
}

This script will update all items of desired Content Type (including items/files in folders and files in Document Sets). However it will not change permissions of parent Folders or Document Sets.

I have tested this on my dev machine. Feel free to ask additional questions.

Answer 3

Here is the working code in case someone needs it.

$webUrl = "http://inside.national.com/Sales"
$web = Get-SPWeb $webUrl
$list = $web.Lists["2011Sales"]
$ct = "2011 Marketing"
$spgroup = "Custom SP Group"
$rd="Contribute"

foreach ($item in $list.items) {
    If ($item.ContentType.Name -eq $ct)
     {  
        $item.ResetRoleInheritance() # Not sure if this line is needed
        $item.BreakRoleInheritance($false) # I tried $true but did not work, so leave it at $false
        $item.SystemUpdate() # Very Important

        $group = $web.AllUsers[$spgroup]
        $roledef = $web.RoleDefinitions[$rd]
        $roleass = New-Object Microsoft.SharePoint.SPRoleAssignment($web.SiteGroups[$spgroup])
        $roleass.RoleDefinitionBindings.Add($roledef)
        $item.RoleAssignments.Add($roleass)
        $item.SystemUpdate() #Update item without changing the updated date
        Write-Host $item.Name " permission applied"
     }
}
$web.dispose()