Delete all users having full control permissions and add contribute permission to them

Question

I want to delete all users in a site having full control permissions and assign them to contribute permissions.

I can able to add contribute permission to them. But while deleting the existing full contribute permission I am getting an error :

"Collection was modified; enumeration operation may not execute."

SPRoleDefinitionCollection WebRoles = web.RoleDefinitions;
        SPRoleDefinition roledef = web.RoleDefinitions["Full Control"];
        SPRoleAssignmentCollection assignColl = web.RoleAssignments;     
 foreach (SPRoleAssignment assignmentgn in assignColl)
        {
            if (assignmentgn.RoleDefinitionBindings.Contains(roledef))
            {
                if (assignmentgn.Member is SPGroup)
                {
                    SPGroup group = (SPGroup)assignmentgn.Member;
                    foreach (SPUser user in group.Users)
                    {
                        if (user.IsSiteAdmin == false)
                        {
                            web.AllowUnsafeUpdates = true;
                            //web.RoleAssignments.Remove(user);
                            SPRoleAssignment newroleassignweb = new SPRoleAssignment(user);
                            newroleassignweb.RoleDefinitionBindings.Add(WebRoles["Contribute"]);
                            web.RoleAssignments.Add(newroleassignweb);
                            web.Update();
                            web.AllowUnsafeUpdates = false;
                        }
                    }
                }
            }
        }

Answer 1

You basically can't make changes to a collection (e.g. add/remove) while you are iterating through the collection, since you are effectively changing the very object that you are iterating, while you are iterating it.

This is one of those cases were Linq would have been great, except for the fact that SPRoleAssignmentCollection does not implement IEnumerable.

Any way, while we could probably improve, below is an example of how we could separate the iteration of the role assignments with the creation of new ones.

        List<SPUser> usersToParse = new List<SPUser>();

        SPRoleDefinitionCollection WebRoles = web.RoleDefinitions;
        SPRoleDefinition roledef = web.RoleDefinitions["Full Control"];
        SPRoleAssignmentCollection assignColl = web.RoleAssignments;
        foreach (SPRoleAssignment assignmentgn in assignColl)
        {
            if (assignmentgn.RoleDefinitionBindings.Contains(roledef))
            {
                if (assignmentgn.Member is SPGroup)
                {
                    SPGroup group = (SPGroup)assignmentgn.Member;
                    foreach (SPUser user in group.Users)
                    {
                        if (user.IsSiteAdmin == false)
                        {
                            usersToParse.Add(user);
                        }
                    }
                }
            }
        }

        foreach(SPUser user in usersToParse)
        {
            web.AllowUnsafeUpdates = true;

            //web.RoleAssignments.Remove(user);
            SPRoleAssignment newroleassignweb = new SPRoleAssignment(user);                
            newroleassignweb.RoleDefinitionBindings.Add(WebRoles["Contribute"]);
            web.RoleAssignments.Add(newroleassignweb);

            web.Update();
            web.AllowUnsafeUpdates = false;
        }