Powershell get permission on SPSite/SPweb (and all list)

Question

Do you know how to get, in powershell, all permission for a SPSite/SPWeb and all list?

Thanks.

Answer 1

Display security permissions for site collection, subsites, and lists/libraries in each site.

To use it, you must modify the $site variable to point to your site collection.

Syntax: <script name>.ps1 | out-file c:\permissions.txt

Here is script

#Add SharePoint PowerShell SnapIn if not already added
if ((Get-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue) -eq $null) {
Add-PSSnapin "Microsoft.SharePoint.PowerShell"
}

#Define variables
$site = Get-SPSite "http://<site collection>"

#Get all subsites for site collection
$web = $site.AllWebs

#Loop through each subsite and write permissions

foreach ($web in $web)
{
if (($web.permissions -ne $null) -and ($web.hasuniqueroleassignments -eq "True"))
{
Write-Output "****************************************"
Write-Output "Displaying site permissions for: $web"
$web.permissions | fl member, basepermissions
}
elseif ($web.hasuniqueroleassignments -ne "True")
{
Write-Output "****************************************"
Write-Output "Displaying site permissions for: $web"
"$web inherits permissions from $site"
}

#Loop through each list in each subsite and get permissions

foreach ($list in $web.lists)
{
$unique = $list.hasuniqueroleassignments
if (($list.permissions -ne $null) -and ($unique -eq "True"))
{
Write-Output "****************************************"
Write-Output "Displaying Lists permissions for: $web \ $list"
$list.permissions | fl member, basepermissions
}
elseif ($unique -ne "True") {
Write-Output "$web \ $list inherits permissions from $web"
}
}
}
Write-Host "Finished."
$site.dispose()
$web.dispose()
$unique.dispose()

Answer 2

You can use below script as a starting point

$webApps = Get-SPWebApplication 
foreach($webApp in $webApps) 
{ 
    foreach($site in $webApp.Sites) 
    { 
        foreach($web in $site.AllWebs) 
        { 
            foreach($assignment in $web.RoleAssignments) 
                { 
                    if(-not [string]::IsNullOrEmpty($assignment.Member.Xml)) 
                    { 
                        $roleBindings = ($assignment.RoleDefinitionBindings | Select-Object -ExpandProperty name) -join "," 
                        Write-Output $assignment.Member.Name
                        Write-Output $roleBindings
                    } 
                } 
            } 
            $web.Dispose() 
        } 
        $site.Dispose() 
    } 
} 

Answer 3

To find unique permissions it is better to use SPWeb.GetWebsAndListsWithUniquePermissions and SPList.GetItemsWithUniquePermissions methods:

$web = Get-SPWeb "<WebURL>"
$web.GetWebsAndListsWithUniquePermissions()

$list = $web.GetList("<ListURL")
$list.GetItemsWithUniquePermissions()