Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have written a script that created a document library called "Audit Logs" for every site collection in our environment. I then wanted to ensure that only Site Collection administrators and the individual site Owners group had access to this document library. I was able to write a script to break the inheritance, allowing only the site collection administrators to view the library.

I was told after the fact that I also needed to make sure the the Owners group was able to access the Audit logs as well.

Here is what I have so far:

$site = Get-SPSite | Get-SPWeb -limit all | ForEach-Object {
$listName = "Audit Logs"


$list = $_.Lists[$listName]
$list.BreakRoleInheritance($False)

$list.Update()
}

How do I add the Owners group to the ACL for each of the Audit Log folders? I have seen various methods for adding individual user accounts, but not for a group.

I am using powershell and Sharepoint 2010 Enterprise.

Thanks in advance!

share|improve this question

3 Answers 3

up vote 9 down vote accepted

This script should do the trick after few adjustments as its adding new permissions to group which you don't want so you can skip them,

function Add-SPPermissionToListGroup
{
    param ($Url, $ListName, $GroupName, $PermissionLevel)
    $web = Get-SPWeb -Identity $Url
    $list = $web.Lists.TryGetList($ListName)
    if ($list -ne $null)
    {
        if ($list.HasUniqueRoleAssignments -eq $False)
        {
            $list.BreakRoleInheritance($True)
        }
        else
        {
            if ($web.SiteGroups[$GroupName] -ne $null)
            {
                $group = $web.SiteGroups[$GroupName]
                $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($group)
                $roleDefinition = $web.RoleDefinitions[$PermissionLevel];
                $roleAssignment.RoleDefinitionBindings.Add($roleDefinition);
                $list.RoleAssignments.Add($roleAssignment)
                $list.Update();
                Write-Host "Successfully added $PermissionLevel permission to $GroupName group in $ListName list. " -foregroundcolor Green
            }
            else
            {
                Write-Host "Group $GroupName does not exist." -foregroundcolor Red
            }
        }
    }
    $web.Dispose()
}

Source

share|improve this answer
    
Thank you! This has given me a good idea how to work out my solution! –  Kevin Jan 30 '13 at 16:44

Thanks, TimeToShine. I appreciate you posting that script, it definitely helped get me to where I needed to be. Here was my final script:

if ( -not $(Get-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction "SilentlyContinue" )) {Add-PSSnapin Microsoft.SharePoint.PowerShell}

$sites = Get-SPSite | Select RootWeb, URL

foreach ($site in $sites){

$ListName = "Audit Logs"
$PermissionLevel = "Full Control"
$web = $site.rootweb
#$web = Get-SpSite -identity $site.url
#$web = Get-SPWeb -Identity $site.url        
$list = $web.Lists | where {$_.Title -match $ListName}
    if ($list -ne $null)
    {
        if ($list.HasUniqueRoleAssignments -eq $False)
        {$list.BreakRoleInheritance($True)}

        if ($list.HasUniqueRoleAssignments -eq $True)
        {
            ForEach ($SiteGroup in $web.SiteGroups) {                    

                if ($SiteGroup.Name -match "Owners")
                {
                    #write-host $SiteGroup.Name
                    $GroupName = $SiteGroup.Name
                    $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($SiteGroup)
                    $roleDefinition = $web.RoleDefinitions[$PermissionLevel];
                    $roleAssignment.RoleDefinitionBindings.Add($roleDefinition);
                    $list.RoleAssignments.Add($roleAssignment)
                    $list.Update();
                    Write-Host "Successfully added <$GroupName> to the <$ListName> list in <$site>. " -foregroundcolor Green
                }                
                else
                {
                     Write-Host "No Owners groups exist." -foregroundcolor Red
                }
            }
            }
        }
    }
share|improve this answer

Just an addendum to this as I came across this post while researching an issue we were having, if you call $List.Update() right after the RoleAssignments.Add(), you may hit a race condition and it'll report a save conflict on the $List item.

it will however update the RoleAssignment as the .Add commits the change without the need to call .Update() on the list.

Paul.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.