PowerShell script to give reader permission for a user in site collection

Question

I have a SharePoint server where I built a site collection that contains many subsites inside.

I want to give a user a reader permission across whole site collection sub sites.

How to do it using a PowerShell script?

Answer 1

This script will ensure reader permissions to specified user across site collection.

Keep in mind: This is not the right way to deal with permissions issues!

$site = Get-SPSite -Identity "http://mysite/"
$user = Get-SPUser -Identity "mydomain\myuser" -Web $site.RootWeb
$assignment = New-Object Microsoft.SharePoint.SPRoleAssignment($user)
$role = $site.RootWeb.RoleDefinitions[[Microsoft.SharePoint.SPRoleType]::Reader]
$assignment.RoleDefinitionBindings.Add($role);

foreach ($web in $site.AllWebs) {
    if ($web.HasUniquePerm) {
        $web.RoleAssignments.Add($assignment)
    } 
}

Note: You need to be Site Collection Admin to use this script.

This is just a quick demonstration and answer to your question but it is not solution to your problem. As I see you have some other issues with permissions settings.

Answer 2

You could certainly do this via PowerShell, but you may not need to (...or want to). If the subsites inherit their permissions from their parent site and ultimately the site collection (...this is the default behavior) then you could simply add that user as a Reader to the site collection (root web) and be good to go.

Answer 3

If you want the person to have unconditional read privileges you might want to consider using a Web Application Policy in Central Admin instead. This will override all security defined in a site collection for that user/permission.

Advantages

1. Define it once and that person has those permissions on all sites in that Web app, regardless of inheritance
2. The user gets the defined permissions even on new sites that are added after you make the change (unlike the aforementioned scripted approach) and on sites that break inheritance
3. SharePoint itself uses this method in order to configure Read permissions for the Search Crawler so it is a well-proven and supported approach.

Disadvantages

1. Permissions set in a Web App Policy override even the strictest item level security, meaning that users set in this fashion can see anything in that web app.
2. These permissions do not appear at all in the UI for the site collection, which makes complete reporting of permissions tricky

If that is the route you want to take, defining a web application policy takes less than a minute and only has to be done once per farm so using a script is probably pointless.