2

I need a script that will list all sites within a web application with their users and given permission.

I found this script which will do basically the same I need, with one problem. It won't get users from an AD group.

Here is the script:

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue 

Function GetUserAccessReport($WebAppURL, $FileUrl) 
{ 
    Write-Host "Generating permission report..." 

    #Get All Site Collections of the WebApp 
    $SiteCollections = Get-SPSite -WebApplication $WebAppURL -Limit All 

    #Write CSV- TAB Separated File) Header 
    "URL`tSite/List/Folder/Item`tTitle/Name`tPermissionType`tPermissions `tLoginName" | out-file $FileUrl 

    #Check Web Application Policies 
    $WebApp= Get-SPWebApplication $WebAppURL 

    foreach ($Policy in $WebApp.Policies)  
      { 
        $PolicyRoles=@() 
        foreach($Role in $Policy.PolicyRoleBindings) 
        { 
            $PolicyRoles+= $Role.Name +";" 
        } 

        "$($AdminWebApp.URL)`tWeb Application`t$($AdminSite.Title)`tWeb Application Policy`t$($PolicyRoles)`t$($Policy.UserName)" | Out-File $FileUrl -Append 
    } 

    #Loop through all site collections 
    foreach($Site in $SiteCollections)  
    { 
      #Check Whether the Search User is a Site Collection Administrator 
      foreach($SiteCollAdmin in $Site.RootWeb.SiteAdministrators) 
          { 
            "$($Site.RootWeb.Url)`tSite`t$($Site.RootWeb.Title)`tSite Collection Administrator`tSite Collection Administrator`t$($SiteCollAdmin.LoginName)" | Out-File $FileUrl -Append 
        } 

       #Loop throuh all Sub Sites 
       foreach($Web in $Site.AllWebs)  
       {     

                #Get all the users granted permissions to the list 
                foreach($WebRoleAssignment in $Web.RoleAssignments )  
                {  
                    #Is it a User Account? 
                    if($WebRoleAssignment.Member.userlogin)     
                    { 
                        #Get the Permissions assigned to user 
                        $WebUserPermissions=@() 
                        foreach ($RoleDefinition  in $WebRoleAssignment.RoleDefinitionBindings) 
                        { 
                            $WebUserPermissions += $RoleDefinition.Name +";" 
                        } 

                        #Send the Data to Log file 
                        "$($Web.Url)`tSite`t$($Web.Title)`tDirect Permission`t$($WebUserPermissions) `t$($WebRoleAssignment.Member.LoginName)" | Out-File $FileUrl -Append 
                    } 
                    #Its a SharePoint Group, So search inside the group and check if the user is member of that group 
                    else   
                    { 
                        foreach($user in $WebRoleAssignment.member.users) 
                        { 
                            #Get the Group's Permissions on site 
                            $WebGroupPermissions=@() 
                            foreach ($RoleDefinition  in $WebRoleAssignment.RoleDefinitionBindings) 
                            { 
                                $WebGroupPermissions += $RoleDefinition.Name +";" 
                            } 

                            #Send the Data to Log file 
                            "$($Web.Url)`tSite`t$($Web.Title)`tMember of $($WebRoleAssignment.Member.Name) Group`t$($WebGroupPermissions)`t$($user.LoginName)" | Out-File $FileUrl -Append 
                        } 
                    } 
                } 


            #********  Check Lists, Folders, and Items with Unique Permissions ********/ 
            foreach($List in $Web.lists) 
            { 
                if($List.Hidden -eq $false) 
                { 
                    #Get all the users granted permissions to the list 
                    foreach($ListRoleAssignment in $List.RoleAssignments )  
                    {  
                        #Is it a User Account? 
                        if($ListRoleAssignment.Member.userlogin)     
                        { 
                            #Get the Permissions assigned to user 
                            $ListUserPermissions=@() 
                            foreach ($RoleDefinition  in $ListRoleAssignment.RoleDefinitionBindings) 
                            { 
                                $ListUserPermissions += $RoleDefinition.Name +";" 
                            } 

                            #Send the Data to Log file 
                            "$($List.ParentWeb.Url)/$($List.RootFolder.Url)`tList`t$($List.Title)`tDirect Permission`t$($ListUserPermissions) `t$($ListRoleAssignment.Member)" | Out-File $FileUrl -Append 
                        } 
                        #Its a SharePoint Group, So search inside the group and check if the user is member of that group 
                        else   
                        { 
                            foreach($user in $ListRoleAssignment.member.users) 
                            { 
                                #Get the Group's Permissions on site 
                                $ListGroupPermissions=@() 
                                foreach ($RoleDefinition  in $ListRoleAssignment.RoleDefinitionBindings) 
                                { 
                                    $ListGroupPermissions += $RoleDefinition.Name +";" 
                                } 

                                #Send the Data to Log file 
                                "$($List.ParentWeb.Url)/$($List.RootFolder.Url)`tList`t$($List.Title)`tMember of $($ListRoleAssignment.Member.Name) Group`t$($ListGroupPermissions)`t$($user.LoginName)" | Out-File $FileUrl -Append 
                            } 
                        }     
                    } 
                 }
          } 
        }     
    } 
} 

#Call the function to Check User Access 
GetUserAccessReport "http://mysite" "C:\SharePoint_Permission_Report.csv" 
Write-Host "Complete" 

Reference

I do know how to get the users in an AD group using something like this

foreach ($grp in $groups)
{
"SP Group: " + $grp.Name;
foreach ($user in $grp.Users)
{
if ($user.IsDomainGroup -eq $False)
{
" User: " + $user.Name
}
else
{
" AD group: " +$user.Name
$adusers={}
$adusers = Get-ADGroupMember -Identity $user.name.split("\")[1]
foreach ($aduser in $adusers)
{
" AD User: " + $aduser.Name
}
}
}
}

But I can't figure how to combine those two pieces because the user property of the second piece doesn't contain the permission information.

Can anyone give me some light?

Thanks in advance.

update:

I now need to add a column to specify if its a domain group.

So I added this to the header:

     #Write CSV- TAB Separated File) Header 
   "URL`tSite/List/Folder/Item`tTitle/Name`tPermissionType`tPermissions`tLoginName`tIsDomainGroup" | out-file $FileUrl 

And now I am trying to pull this information from here:

  if($WebRoleAssignment.Member.userlogin)     
                { 
                    #Get the Permissions assigned to user 
                    $WebUserPermissions=@() 
                    foreach ($RoleDefinition  in $WebRoleAssignment.RoleDefinitionBindings) 
                    { 
                        $WebUserPermissions += $RoleDefinition.Name +";" 
                    } 

                      if($WebRoleAssignment.Member.IsDomainGroup)
                            {
                            $IsDomainGroup = $true
                            }


                        if(!$Web.Url)
                        {
                        $Web.Url = "webapplication"
                        }

                    #Send the Data to Log file 
                    "$($Web.Url)`tSite`t$($Web.Title)`tDirect Permission`t$($WebUserPermissions) `t$($WebRoleAssignment.Member.LoginName)" | Out-File $FileUrl -Append 
                } 

But I am not sure how to insert $IsDomainGroup to the output file

2
+50

you can try to get the sid from the DisplayName (DOMAIN\LOGINNAME)

$adObj = New-Object System.Security.Principal.NTAccount($WebRoleAssignment.Member.DisplayName)
$sid = $adObj.Translate([System.Security.Principal.SecurityIdentifier])

ref

now, another thing you may bump into is group hierarchies, meaning, groups inside groups, and you may want to know what are the actual users, not the groups themselves, and for that you can use a recursive method.

here's a rough example, I'm sure there is room for improvement

#recurse groups
function Get-ADNestedGroupMembers {
[cmdletbinding()]
param (
[String] $GroupName
)            

import-module activedirectory
$Members = Get-ADGroupMember -Identity $GroupName
$members | % {
    if($_.ObjectClass -eq "group") {
        Get-ADNestedGroupMembers -GroupName $_.distinguishedName
    } else {
        #return $_.distinguishedname
        return $_.Name
    }
}            

}

foreach($WebRoleAssignment in $Web.RoleAssignments)  
{  
    #Is it a User Account? 
    if($WebRoleAssignment.Member.userlogin)     
    { 
        #Get the Permissions assigned to user 
        $WebUserPermissions=@() 
        foreach ($RoleDefinition  in $WebRoleAssignment.RoleDefinitionBindings) 
        { 
            $WebUserPermissions += $RoleDefinition.Name +";" 
            write-host "USER " $WebRoleAssignment.Member.DisplayName " " $RoleDefinition.Name "DOMAIN: " $WebRoleAssignment.Member.IsDomainGroup
            #write-host ""
            #write-host "AD GROUP" $WebRoleAssignment.Member
            #$WebRoleAssignment.Member | select *

            if($WebRoleAssignment.Member.IsDomainGroup)
            {
                $adObj = New-Object System.Security.Principal.NTAccount($WebRoleAssignment.Member.DisplayName)
                $sid = $adObj.Translate([System.Security.Principal.SecurityIdentifier]) 
                Get-ADNestedGroupMembers -GroupName $sid
            }
        } 

        #Send the Data to Log file 
        #"$($Web.Url)`tSite`t$($Web.Title)`tDirect Permission`t$($WebUserPermissions) `t$($WebRoleAssignment.Member.LoginName)" | Out-File $FileUrl -Append 
    } 
    #Its a SharePoint Group, So search inside the group and check if the user is member of that group 
    else   
    { 
        foreach($user in $WebRoleAssignment.member.users) 
        { 
            #Get the Group's Permissions on site 
            $WebGroupPermissions=@() 
            foreach ($RoleDefinition  in $WebRoleAssignment.RoleDefinitionBindings) 
            { 
                $WebGroupPermissions += $RoleDefinition.Name +";" 
                write-host "GROUP USER" $user.DisplayName " " $RoleDefinition.Name

                if($user.IsDomainGroup)
                {
                    $adObj = New-Object System.Security.Principal.NTAccount($user.DisplayName)
                    $sid = $adObj.Translate([System.Security.Principal.SecurityIdentifier]) 
                    Get-ADNestedGroupMembers -GroupName $sid        
                }

            } 

            #Send the Data to Log file 
            #"$($Web.Url)`tSite`t$($Web.Title)`tMember of $($WebRoleAssignment.Member.Name) Group`t$($WebGroupPermissions)`t$($user.LoginName)" | Out-File $FileUrl -Append 
        } 
    } 
} 
  • this may be a dumb question, but why did you comment the sending of the data to the log file – ranbo Feb 22 '17 at 19:25
  • just to test without it throwing errors due to missing previous code! – Tiago Duarte Feb 22 '17 at 19:29
  • Oh, ok. Also, do I need any library or call to use Get-ADNestedGroupMembers? My powershell(2.0) doesn't know this function. – ranbo Feb 22 '17 at 19:31
  • 1
    the function is right there in my answer! :) – Tiago Duarte Feb 22 '17 at 19:50
  • I didn't have the AD Module on my SP Server. It's working now! Many thanks, – ranbo Feb 22 '17 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.