Powershell script to find permissions for a specific user

Question

what am i doing wrong

user.ps1
    $user = "sp2010\systemsacct"
    $site = $gc | Get-SPSite sp2010
    $site | Get-SPWeb -Limit All | Get-SPUserEffectivePermissions $user   Out-GridView -Title "Web Permissions for $user"

Answer 1

This script gives you a table of user only permissions and permissions via group membership.

$urlWeb = "http://sp2010"
Get-SPUser -Web $urlWeb | select UserLogin, @{name=”Exlicit given roles”;expression={$_.Roles}}, @{name=”Roles given via groups”;expression={$_.Groups | %{$_.Roles}}},Groups | format-Table -auto

Answer 2

Found this PowerShell script which scans these areas to to retrieve a specific user's access rights:

• Farm Administrator's Group
• Central Administration Web Application Policies
• Site Collection Administrators
• Scans the all Site collections and Sub-sites with Unique Permissions
• Scans all Lists and Libraries with unique permissions
• Scans all Groups which has permissions on sites and Lists

After executing the script, it generates a CSV file (Tab Separated, In fact!) with details: URL, Site/List, Title, Permission Type, Permissions as in the below screenshot. Refer: SharePoint Permission Report: Check Access Rights for a Specific User http://www.sharepointdiary.com/2013/01/permission-report-for-specific-user.html

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

Function GetUserAccessReport($WebAppURL, $SearchUser, [Switch]$verbos){
    [Integer]$writeHostPrefixCount = 0
    [String]$writeHostPrefixType = "  "
    #Output Report location
    $OutputReport = ".\UserAccessReport.csv"

    #delete the file, If already exist!
    if (Test-Path $OutputReport) {
        Remove-Item $OutputReport
    }

    if($verbos){ Write-host "$($writeHostPrefixType*$writeHostPrefixCount)Scanning Farm Administrator Group..." }

    #Write CSV- TAB Separated File) Header
    "URL`tSite/List`tTitle`t PermissionType`tPermissions" | out-file $OutputReport

    ####Check Whether the Search Users is a Farm Administrator ###
    #Get the SharePoint Central Administration site
    $AdminWebApp= Get-SPwebapplication -includecentraladministration | ? {
        $_.IsAdministrationWebApplication
    }

    $AdminSite = Get-SPweb $AdminWebApp.Url
    $AdminGroupName = $AdminSite.AssociatedOwnerGroup
    $FarmAdminGroup = $AdminSite.SiteGroups[$AdminGroupName]

    #enumerate in farm adminidtrators groups
    foreach ($user in $FarmAdminGroup.users) {
        if($user.LoginName -eq $SearchUser) {
            "$($AdminWebApp.URL)`tFarm`t$($AdminSite.Title)`t Farm Administrator`tFarm Administrator" | Out-File $OutputReport -Append
        }    
    }

    ### Check Web Application Policies ###
    if($verbos){ Write-host "$($writeHostPrefixType*$writeHostPrefixCount)Scanning Web Application Policies..." }
    $WebApp= Get-SPWebApplication $WebAppURL

    foreach ($Policy in $WebApp.Policies) {
        #Check if the search users is member of the group
        if($Policy.UserName -eq $SearchUser) {
            [Integer]$writeHostPrefixCount = 1
            if($verbos){ Write-Host $($writeHostPrefixType*$writeHostPrefixCount)$Policy.UserName -ForegroundColor Red }
            $PolicyRoles=@()
            foreach($Role in $Policy.PolicyRoleBindings) {
                $PolicyRoles+= $Role.Name +";"
            }
            if($verbos){ Write-Host "$($writeHostPrefixType*$writeHostPrefixCount)Permissions: " $PolicyRoles -ForegroundColor Red }
            "$($AdminWebApp.URL)`tWeb Application`t$($AdminSite.Title)`t  Web Application Policy`t$($PolicyRoles)" | Out-File $OutputReport -Append
        }
    }

    [Integer]$writeHostPrefixCount = 0
    if($verbos){ Write-host "$($writeHostPrefixType*$writeHostPrefixCount)Scanning Site Collections..." }
    #Get All Site Collections of the WebApp
    $SiteCollections = Get-SPSite -WebApplication $WebAppURL -Limit All

    #Loop through all site collections
    foreach ($Site in $SiteCollections) {
        [Integer]$writeHostPrefixCount = 1
        if($verbos){ Write-host "$($writeHostPrefixType*$writeHostPrefixCount)Scanning Site Collection:" $site.Url }
        #Check Whether the Search User is a Site Collection Administrator
        foreach ($SiteCollAdmin in $Site.RootWeb.SiteAdministrators) {
            if($SiteCollAdmin.LoginName -eq $SearchUser) {
                "$($Site.RootWeb.Url)`tSite`t$($Site.RootWeb.Title)`t Site Collection Administrator`tSite Collection Administrator" | Out-File $OutputReport -Append
            }    
        }

        #Loop throuh all Sub Sites
        foreach ($Web in $Site.AllWebs) {
            [Integer]$writeHostPrefixCount = 2
            if($Web.HasUniqueRoleAssignments -eq $True) {
                if($verbos){ Write-host "$($writeHostPrefixType*$writeHostPrefixCount)Scanning Site:" $Web.Url }

                #Get all the users granted permissions to the list
                foreach($WebRoleAssignment in $Web.RoleAssignments ) {
                    [Integer]$writeHostPrefixCount = 3
                    #Is it a User Account?
                    if($WebRoleAssignment.Member.userlogin) {
                        #Is the current user is the user we search for?
                        if($WebRoleAssignment.Member.LoginName -eq $SearchUser) {
                            if($verbos){ Write-Host  $($writeHostPrefixType*$writeHostPrefixCount)$SearchUser has direct permissions to site $Web.Url -ForegroundColor Red }
                            #Get the Permissions assigned to user
                            $WebUserPermissions=@()
                            foreach ($RoleDefinition  in $WebRoleAssignment.RoleDefinitionBindings) {
                                $WebUserPermissions += $RoleDefinition.Name +";"
                            }
                            if($verbos){ write-host "$($writeHostPrefixType*$writeHostPrefixCount)with these permissions: " $WebUserPermissions -ForegroundColor Red }

                            #Send the Data to Log file
                            "$($Web.Url)`tSite`t$($Web.Title)`t Direct Permission`t$($WebUserPermissions)" | Out-File $OutputReport -Append
                        }
                    }
                    #Its a SharePoint Group, So search inside the group and check if the user is member of that group
                    else {
                        foreach($user in $WebRoleAssignment.member.users) {
                            #Check if the search users is member of the group
                            if($user.LoginName -eq $SearchUser) {
                                if($verbos){ Write-Host  "$($writeHostPrefixType*$writeHostPrefixCount)$SearchUser is Member of " $WebRoleAssignment.Member.Name "Group" -ForegroundColor Red }
                                #Get the Group's Permissions on site
                                $WebGroupPermissions=@()
                                foreach ($RoleDefinition  in $WebRoleAssignment.RoleDefinitionBindings) {
                                    $WebGroupPermissions += $RoleDefinition.Name +";"
                                }
                                if($verbos){ write-host "$($writeHostPrefixType*$writeHostPrefixCount)Group has these permissions: " $WebGroupPermissions -ForegroundColor Red }

                                #Send the Data to Log file
                                "$($Web.Url)`tSite`t$($Web.Title)`t Member of $($WebRoleAssignment.Member.Name) Group`t$($WebGroupPermissions)" | Out-File $OutputReport -Append
                            }
                        }
                    }
                }
            }

            ###*****  Check Lists with Unique Permissions *******###
            foreach($List in $Web.lists) {
                [Integer]$writeHostPrefixCount = 3
                if($List.HasUniqueRoleAssignments -eq $True -and ($List.Hidden -eq $false)) {
                    if($verbos){ Write-host "$($writeHostPrefixType*$writeHostPrefixCount)Scanning List:" $List.RootFolder.Url }
                    #Get all the users granted permissions to the list
                    foreach($ListRoleAssignment in $List.RoleAssignments ) {
                        [Integer]$writeHostPrefixCount = 4
                        #Is it a User Account?
                        if($ListRoleAssignment.Member.userlogin) {
                            #Is the current user is the user we search for?
                            if($ListRoleAssignment.Member.LoginName -eq $SearchUser) {
                                if($verbos){ Write-Host  $($writeHostPrefixType*$writeHostPrefixCount)$SearchUser has direct permissions to List ($List.ParentWeb.Url)/($List.RootFolder.Url) -ForegroundColor Red }
                                #Get the Permissions assigned to user
                                $ListUserPermissions=@()
                                foreach ($RoleDefinition  in $ListRoleAssignment.RoleDefinitionBindings) {
                                    $ListUserPermissions += $RoleDefinition.Name +";"
                                }
                                if($verbos){ write-host "$($writeHostPrefixType*$writeHostPrefixCount)with these permissions: " $ListUserPermissions -ForegroundColor Red }

                                #Send the Data to Log file
                                "$($List.ParentWeb.Url)/$($List.RootFolder.Url)`tList`t$($List.Title)`t Direct Permissions`t$($ListUserPermissions)" | Out-File $OutputReport -Append
                            }
                        }
                        #Its a SharePoint Group, So search inside the group and check if the user is member of that group
                        else {
                            foreach($user in $ListRoleAssignment.member.users) {
                                if($user.LoginName -eq $SearchUser) {
                                    if($verbos){ Write-Host  "$($writeHostPrefixType*$writeHostPrefixCount)$SearchUser is Member of " $ListRoleAssignment.Member.Name "Group" -ForegroundColor Red }
                                    #Get the Group's Permissions on site
                                    $ListGroupPermissions=@()
                                    foreach ($RoleDefinition  in $ListRoleAssignment.RoleDefinitionBindings) {
                                        $ListGroupPermissions += $RoleDefinition.Name +";"
                                    }
                                    if($verbos){ write-host "$($writeHostPrefixType*$writeHostPrefixCount)Group has these permissions: " $ListGroupPermissions -ForegroundColor Red }

                                    #Send the Data to Log file
                                    "$($Web.Url)`tSite`t$($List.Title)`t Member of $($ListRoleAssignment.Member.Name) Group`t$($ListGroupPermissions)" | Out-File $OutputReport -Append
                                }
                            }
                        }
                    }
                }
            }
        }
    }

    Write-host "`n Access Rights Report Generated!" -ForegroundColor Green
}


#Call the function to Check User Access
GetUserAccessReport "http://sharepoint.crescent.com" "i:0#.w|Global\Salaudeen"

Read more: http://www.sharepointdiary.com/2013/01/permission-report-for-specific-user.html#ixzz2macjy36a