6

I am trying to modify the permission level of SharePoint groups and users with direct permission using PowerShell, e.g. if group/user has been given full control, I need to modify it to read.

I have created a script which will remove that groups permission and add it again with read access. But, the issue here is that when I remove the group from site collection, it gets removed from all libraries also. So, for workaround I'm storing the group names in an array and again adding them to each library.

Is it possible to just modify the permission level of a SharePoint group and users with direct permission using PowerShell?

code:

for($i = 0; $i -lt $WebRoleAssignments.Count; $i++){
$WebRoleAssignment = $web.RoleAssignments[$i]
$Member = $WebRoleAssignment.Member
$web.RoleAssignments.Remove($Member)
Write-Host Default Permissions Removed for $Member

$assignment = new-object Microsoft.SharePoint.SPRoleAssignment($Member)
$permission = $web.RoleDefinitions["Read"]
$assignment.RoleDefinitionBindings.Add($permission)
$web.RoleAssignments.Add($assignment)
Write-Host Read access granted for $Member
$groups += $Member
}

1 Answer 1

12

Try below code:

This will remove group permission full control

$web = get-spweb http://url/to/your/web
$group = $web.SiteGroups["Owners"]
$ra = $group.ParentWeb.RoleAssignments.GetAssignmentByPrincipal($group)
$rd = $group.ParentWeb.RoleDefinitions["Full Control"]
$ra.RoleDefinitionBindings.Remove($rd)
$ra.Update()
$group.Update()
$web.Dispose()

This will assign Read permission to group

# The following could be applied to a web or a user.
$web = get-spweb http://url/to/your/web
$group = $web.Groups["Owners"]
$role = $web.RoleDefinitions["Read"]

$RoleAssignment = New-Object Microsoft.SharePoint.SPRoleAssignment($group)
$RoleAssignment.RoleDefinitionBindings.Add($role)

# the following could be for a web, list or item object
$web.RoleAssignments.Add($RoleAssignment)
$web.Update()
$web.Dispose()

Change group names as per your requirement

2
  • Thanks Gautam, this code works perfectly for groups but I also have some users who have been granted access directly. With this code, it won't modify permission of the users.
    – kaz
    Nov 25, 2016 at 7:03
  • Ok, I got it. $groups = $web.Groups; $users = $web.Users This servers my purpose. Thanks a lot for guiding. :)
    – kaz
    Nov 25, 2016 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.