1

I did an export of a subweb and imported it to a new top level site collection. To keep all the unique permission on all folders and files, I had to use -IncludeUserSecurity, which has brought over all users from the previous site collection. For example, I have 200 users with access throughout broken/uniquely permissioned items in the site, but 400 users have no access via groups, so I need to purge those 400 users without accidentally removing any of the 200 that would show as limited access at the root, because they are added somewhere deep below.

I thought of doing this with something like a foreach $user in $users and then delete the user if the site collection permission level is set to none, but I am unsure how to get the clean reference of the permission level "none".

Can someone help me with this script? Again, I would need to read in all site collection users into the array, and then delete the user if they have a permission level of none.

Additionally, can this be done with groups the same way?

Edit: So far I have this to capture the accounts that have permissions.

$site = Get-SPSite 'https://site'
Get-SPUser -web $site.URL -Limit All | select UserLogin, @{name="Roles";expression={$_.Roles}}, @{name="Roles in groups";expression={$_.Groups | %{$_.Roles}}},Groups | Where-Object {$_.Roles -ne $null -or ($_.Groups | %{$_.Roles}) -ne $null}

Edit 2: Looks like I can return null properly by checking if $.Roles.count -eq 0. Turns out that the output was dirty, so checking for the string of "Contributor", "Full Control", etc is not reliable, and needed to use -like, which does not help with $null. Even when using $.Roles.name, it mostly worked for the string value of "Contributor", etc., but some of the values were returned wrapped in curly braces {} and still go through when checking for $null. Not sure if the account records are corrupt or not. Anyway, .count is clean. Thanks to a friend that pointed this out.

$UsersWithoutPermissions = Get-SPUser -web $site.URL -Limit All | select UserLogin, @{name="Roles";expression={$_.Roles}}, @{name="Roles in groups";expression={$_.Groups | %{$_.Roles}}}, Groups | Where-Object {$_.Roles.count -eq 0 -and ($_.Groups | %{$_.Roles}) -eq $null}
2

Complete! For anyone else this may help, send me $1,000, lol.

Okay, you can have it.

# Add SharePoint snap-in for use in standard PowerShell console
Add-PSSnapin Microsoft.SharePoint.PowerShell -erroraction SilentlyContinue
# Allow global assignment of values
Start-SPAssignment -Global
        $site = Get-SPSite 'http://domain.com'
        $UserList = Get-SPUser -web $site.URL -Limit All | select UserLogin, @{name="Roles";expression={$_.Roles}}, @{name="Roles in groups";expression={$_.Groups | %{$_.Roles}}}, Groups      
        $UsersWithPermissions = Get-SPUser -web $site.URL -Limit All | select UserLogin, @{name="Roles";expression={$_.Roles}}, @{name="Roles in groups";expression={$_.Groups | %{$_.Roles}}}, Groups | Where-Object {$_.Roles -ne $null -or ($_.Groups | %{$_.Roles}) -ne $null}
        $UsersWithoutPermissions = Get-SPUser -web $site.URL -Limit All | select UserLogin, @{name="Roles";expression={$_.Roles}}, @{name="Roles in groups";expression={$_.Groups | %{$_.Roles}}}, Groups | Where-Object {$_.Roles.count -eq 0 -and ($_.Groups | %{$_.Roles}) -eq $null}
        $a = 0
        $b = 0
        $c = 0
        foreach ($x in $UserList)
        {
            $a = $a + 1
        }
        foreach ($y in $UsersWithPermissions)
        {
            $b = $b + 1
        }
        foreach ($z in $UsersWithoutPermissions)
        {
            $c = $c + 1
            Remove-SPUser $z.UserLogin -web $site.URL -Confirm:$False
            Write-Output "$($z.UserLogin) has been removed."
        }

        Write-Output "`nNumber of accounts: $a"
        Write-Output "`nNumber of accounts with Permission: $b"
        Write-Output "`nNumber of accounts without Permission: $c"
Stop-SPAssignment -Global
0

I tried this in my UAT environmenet, and my results show it didn't account for unique permissions items. I think this still needs some work to be complete.
In my test cases, the users granted privileges to unique permssions items were also deleted.
Close but no cigar.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.