Find list of users having Full Control, Desginer acess from sites and sub-sites

Question

Can someone pls provide a script to return list of users having designer and above permissions for each site and sub-site. Thank you.

Answer 1

This will list out the role assignments on web, list, items for users and SharePoint groups.

Start-SPAssignment -global    
$sites = Get-SPsite -limit All

foreach ($site in $sites)
{
    foreach ($web in $site.allwebs)
    {
        Write-Host -BackgroundColor green -ForegroundColor white $web.url
        $web.RoleAssignments

        foreach ($list in $web.lists)
        {
           If ($list.HasUniqueRoleAssignments)
           {
                Write-Host -BackgroundColor yellow -ForegroundColor black $list.Title
                $list.RoleAssignments

                foreach ($item in $list.Items)
                {
                    If ($item.HasUniqueRoleAssignments)
                    {
                        Write-Host -BackgroundColor red -ForegroundColor yellow $item.UniqueId
                        $item.RoleAssignments
                    }
                }
           }
        }
    }
}
Stop-SPAssignment -global

Answer 2

$webapp = Get-SPWebApplication https://SharePoint.domain.com $sites = $webapp | Get-SPSite -Limit All $webs =  $sites | Get-SPWeb -Limit All foreach ($web in $webs) {
    $users = $web.siteusers
    write-host "Processing " $web.url -foregroundcolor cyan
    write-host "Site Admins:" -foregroundcolor yellow
    foreach ($user in $users) {
        if ($user.IsSiteAdmin) {
            write-host $user.Name
        }
        #write-host $user.Name "IstSiteAdmin: " $user.isSiteAdmin
    }
    Write-host "Site Owners" -foregroundcolor green
    foreach ($user in $users) {
        if ($web.DoesUserHavePermissions($user,[Microsoft.SharePoint.SPBasePermissions]::FullMask)) {
            write-host $user.Name
        }
    } }

This Gives a list of site admins for the site to start with, then a list of users with the Full Control permission to the site.

For Designer permission :

You have to make

 Write-host "Designners" -foregroundcolor green
        foreach ($user in $users) {
            if ($web.DoesUserHavePermissions($user,[Microsoft.SharePoint.SPBasePermissions]::"**Relative permission enumartion value from the SpBasePermission ** ")) {
                write-host $user.Name

Refrence Link : SpbasePermission in Sharepoint