I am trying to programmatically remove permissions from a specific Sharepoint folder for a user or group.

However, when I get to the folders RoleAssignments I do not get a RoleAssignment for the user or group I am looking for.

I am a little confused because I do get users or groups showing in the RoleAssignments but it's never the complete list that is shown on the Sharepoint web page.

If you do a search for this string in my code " 'This is helpful for debugging to see the users/groups in the RoleAssignments. ", just below it I am looping through the RoleAssignments to see all users/groups that have permissions to the folder. I never seem to get the complete list. For example, if I go to the directory on Sharepoint I can see 3 users/groups that have access to a folder. However, there is only 1 users/groups returned through the RoleAssignments.

Here it the code:

    Function RemoveGroups(ByVal myWeb As SPWeb, ByVal arrGroupName() As String, ByVal arrFileName() As String, Optional ByVal strVerboseLog As String = "FALSE") As String()
        'Dim myTopWeb As SPWeb = New SPSite(myWeb.ParentWeb.Url).OpenWeb
        Dim openUrl As String = myWeb.Url & "/Documents"
        Dim myTopWeb As SPWeb = New SPSite(openUrl).OpenWeb
        Dim colGroups As SPGroupCollection = myTopWeb.SiteGroups
        Dim strGroupOwner As String = strDataOwner
        Dim oOwner As SPUser
        Dim oDefaultUser As SPMember
        Dim mySite As SPSite = New SPSite(destCollection)
        Dim rootWeb As SPWeb = mySite.OpenWeb


            oOwner = myTopWeb.Users(strGroupOwner)
            oDefaultUser = myTopWeb.Users(strGroupOwner)
        Catch ex As Exception
            Dim strError As String = "Error setting the owner and default user to " + strGroupOwner + ": " & ex.Message
            writeTospLog(strError, "Error", "[RemoveGroups]", True)
        End Try

        For i As Integer = 0 To arrGroupName.GetUpperBound(0)
            arrGroupName(i) = replaceIllegalGroupCharacters(arrGroupName(i))


                'Dim myGroup As SPGroup = myTopWeb.SiteGroups(arrGroupName(i))
                Dim myGroup As SPGroup = colGroups(arrGroupName(i))
                Dim myRoleAssignments As SPRoleAssignmentCollection = myTopWeb.RoleAssignments
                Dim myRoleAssignment As SPRoleAssignment = myRoleAssignments.GetAssignmentByPrincipal(DirectCast(myGroup, SPPrincipal)) 'New SPRoleAssignment(DirectCast(myGroup, SPPrincipal))
                Dim myRoleDefBindings As SPRoleDefinitionBindingCollection = myRoleAssignment.RoleDefinitionBindings

                writeTospLog("Removing " + arrGroupName(i) + " as a site group and removing " + strPermissionName + " Permissions", "Message", "[RemoveGroups]", True)

                Dim oSubWeb As SPWeb = rootWeb.Webs(destSite)

                Dim myFolder As SPFolder = oSubWeb.Folders.Item("Documents")

                Dim folders As String() = Nothing
                Dim separator As Char() = "\"

                folders = arrFileName(0).Split(separator, StringSplitOptions.RemoveEmptyEntries)

                'Looping through the directories in the Documents library.
                For Each thisFolder As SPFolder In myFolder.SubFolders
                    'Dim folderName As String = thisFolder.Name
                    Dim currentFolder As String
                    Dim finalFolder As SPFolder
                    Dim removePermissions As Boolean = False

                    'Check to see if first level name matches our first level name from the database.
                    If folders(0) = thisFolder.Name Then
                        'Looping through all subdirectories until we get to the directory we need to change the permissions on.
                        For Each currentFolder In folders

                            'Checking to make sure the folder exists in the parent directory.
                            'This is meant to handle bad paths or paths that no longer exists.
                            If thisFolder.Name <> currentFolder Then
                                finalFolder = thisFolder.SubFolders(currentFolder)
                                thisFolder = finalFolder
                                removePermissions = True
                            End If

                        Next currentFolder

                    End If

                    If removePermissions = True Then

                        'This is helpful for debugging to see the users/groups in the RoleAssignments.

                        For Each currentRole As SPRoleAssignment In finalFolder.Item.RoleAssignments
                            If myRoleAssignment.Member.Name = currentRole.Member.Name Then
                                Dim test As String = currentRole.Member.Name
                            End If
                            Dim currentID As Integer = currentRole.Member.ID
                            Dim currentName As String = currentRole.Member.Name
                            For Each role As SPRole In currentRole.Member.Roles
                                Dim roleName As String = role.Name
                                Dim roleID As Integer = role.ID




                    End If


            Catch ex2 As Exception
                Dim strError As String = "Error removing group: " & ex2.Message
                writeTospLog(strError, "Error", "[RemoveGroups]", True)
            End Try
            'End Try
        Return arrGroupName
    End Function
  • It was a permissions issue. It has been resolved.
    – Anonymous
    Commented Mar 15, 2010 at 14:47

3 Answers 3


When you call BreakRoleInheritance with false, it does not copy the existing inherited permissions. That could be why you are not seeing everything that you see through the UI.

  • why would it show in the UI if they were not copied across? Commented Mar 10, 2010 at 18:15
  • Hrmm... I misread the code. I thought he was breaking role inheritance and then iterating through. What happens if you call 'finalFolder.Item.BreakRoleInheritance(True)' before you iterate through your RoleAssignments? Maybe the RoleAssignments collection isn't accurate when permissions are being inherited.
    – MBSurf
    Commented Mar 10, 2010 at 19:36

I would double check some of your assumptions. Are you sure you are comparing the same folders?

I presume you have actually stepped through the code?


the user your code is run as needs to have the EnumeratePermissions SPBasepermission

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.