a PowerShell script using the Client Side Object Model – the script is executed every night.
- The script iterates through a couple of lists each night a performs a
couple of actions: Checks for new items
- Based on the list item data, find the column ‘EmployeeId’ and query
active directory to find the User Principle Name (UPN) (EmployeID is
stored against each user in AD).
- If the above action finds a user from AD the script removes all
permissions on the list item and sets unique permissions so only the
employee and a management group have access to that list item.
The following code snippets assume a connection to SharePoint is open (ClientContext), and the current web is loaded into context.
To find the SharePoint group the following was used:
# Load in list of groups on the current web.
$groups = $web.SiteGroups
$ctx.Load($groups)
$ctx.ExecuteQuery()
# Find the group called HR. Note - using GetGroupByName was not working, therefore I had to iterate through the groups.
foreach($group in $groups)
{
if($group.Title -eq "hr")
{
$hrGrp = $group.Id
}
}
# Get the group and load into context to be used.
$spGrp = $groups.GetById($hrGrp)
$ctx.Load($spGrp);
$ctx.ExecuteQuery();
To set item level permission on each list item:
# Get the list by Title and load.
$list = $web.Lists.GetByTitle("MyListcctx.Load($list)
$ctx.ExecuteQuery()
$listTitle = $list.Title
# Simple query - purely used to ensure all data is returned.
$camlQuery = New-Object microsoft.SharePoint.Client.CamlQuery
$camlQuery.ViewXml = "10000"
# Load in the items.
$collListItem = $list.GetItems($camlQuery)
$ctx.Load($collListItem)
$ctx.ExecuteQuery()
# Iterate through each item.
foreach ($item in $collListItem)
{
# reset variable to ensure no false positives.
$upn = $null
$user = $null
$roleAssignment = $null
$continue = $false
# Set a couple of variable, get the user from AD based on employee number.
$recordId = $item.Id
$upn = Get-Upn -eid $item["EmployeeID"]
$continue = $false
if($upn -ne $null)
{
$continue = $true
}
else
{
Add-LogMessage "ERROR: Missing employee number on record '$recordId' "
}
if($continue)
{
# Break inheritance on the list item and remove existing permissons.
$item.BreakRoleInheritance($false, $true)
# Get the permissions role for 'Read' and 'Edit'.
$reader = $web.RoleDefinitions.GetByName("Read");
$Editor = $web.RoleDefinitions.GetByName("Edit");
# Create a role assignment and apply the 'read' role.
$roleAssignment = New-Object microsoft.SharePoint.Client.RoleDefinitionBindingCollection($ctx)
$roleAssignment.Add($reader)
# Create a role assignment for editors - applying the 'edit' role.
$roleAssignmentEditor = New-Object microsoft.SharePoint.Client.RoleDefinitionBindingCollection($ctx)
$roleAssignmentEditor.Add($Editor)
# Ensure the user exists on the site level, using EnsureUser.
$user = $ctx.Site.RootWeb.EnsureUser($upn)
$ctx.Load($user)
# Apply the two permission roles to the list item.
# $user is a SharePoint user.
$ctx.Load($item.RoleAssignments.Add($user, $roleAssignment))
# spGrp is the HR group returned in the above snippet.
$ctx.Load($item.RoleAssignments.Add($spGrp, $roleAssignmentEditor))
# Update field on the list item to show it has ben processed.
$item["A001"] = "PROCESSED"
$item.Update()
}
# Execute changes.
$ctx.ExecuteQuery();
}
http://dhendry.wordpress.com/2014/08/14/sharepoint-item-level-permissions-using-powershell-and-csom/
But if you want a workflow to set the item level permission check the below
http://www.sharepointbriefing.com/spcode/article.php/3911751/Implementing-ItemLevel-Security-in-SharePoint-2010-and-2007.htm
http://johnliu.net/blog/2010/7/13/sharepoint-2010-configuring-list-item-permissions-with-workf.html
