I am trying to modify the permission level of SharePoint groups and users with direct permission using PowerShell, e.g. if group/user has been given full control, I need to modify it to read.

I have created a script which will remove that groups permission and add it again with read access. But, the issue here is that when I remove the group from site collection, it gets removed from all libraries also. So, for workaround I'm storing the group names in an array and again adding them to each library.

Is it possible to just modify the permission level of a SharePoint group and users with direct permission using PowerShell?

code:

for($i = 0; $i -lt $WebRoleAssignments.Count; $i++){
$WebRoleAssignment = $web.RoleAssignments[$i]
$Member = $WebRoleAssignment.Member
$web.RoleAssignments.Remove($Member)
Write-Host Default Permissions Removed for $Member

$assignment = new-object Microsoft.SharePoint.SPRoleAssignment($Member)
$permission = $web.RoleDefinitions["Read"]
$assignment.RoleDefinitionBindings.Add($permission)
$web.RoleAssignments.Add($assignment)
Write-Host Read access granted for $Member
$groups += $Member
}
up vote 11 down vote accepted

Try below code:

This will remove group permission full control

$web = get-spweb http://url/to/your/web
$group = $web.SiteGroups["Owners"]
$ra = $group.ParentWeb.RoleAssignments.GetAssignmentByPrincipal($group)
$rd = $group.ParentWeb.RoleDefinitions["Full Control"]
$ra.RoleDefinitionBindings.Remove($rd)
$ra.Update()
$group.Update()
$web.Dispose()

This will assign Read permission to group

# The following could be applied to a web or a user.
$web = get-spweb http://url/to/your/web
$group = $web.Groups["Owners"]
$role = $web.RoleDefinitions["Read"]

$RoleAssignment = New-Object Microsoft.SharePoint.SPRoleAssignment($group)
$RoleAssignment.RoleDefinitionBindings.Add($role)

# the following could be for a web, list or item object
$web.RoleAssignments.Add($RoleAssignment)
$web.Update()
$web.Dispose()

Change group names as per your requirement

  • Thanks Gautam, this code works perfectly for groups but I also have some users who have been granted access directly. With this code, it won't modify permission of the users. – kaz Nov 25 '16 at 7:03
  • Ok, I got it. $groups = $web.Groups; $users = $web.Users This servers my purpose. Thanks a lot for guiding. :) – kaz Nov 25 '16 at 7:11

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.