Use PowerShell on a large site to do a permissions find and replace

Question

I've inherited a site collection that has 20,000+ subsites. I cannot connect any management tools to it like Metalogix or ShareGate and I've been told PowerShell will fix it.

I hope to batch the jobs into runs of around 500 with the batch of 500 subsites being loaded from a reference file like a CSV.

I've been told the commands required can only run server side and that to run against 500 sites in a batch, the entire site collection permissions would need to be loaded in each time. Is this correct, it sounds very inefficient.

A little more info. Each subsite uses between 3-5 AD groups to set permissions at its root. Each AD group is set a custom permission level. I'm presuming PowerShell can also manipulate permission levels when adding AD groups?

Thanks

Answer 1

Don't know why you would need to batch it but you could quickly test it to see if you can return that number of sites:

$site = Get-SPSite http://sharepoint/sites/yoursite
$webs = $site.AllWebs

If that completes without error and you can see all the webs in $webs then you really don't need to batch the operation. You could run client side commands if you need to (even web services) but this will probably be easier server side.

You can change permission levels as required but if I were you I would do something like:

#Reset any custom permissions:
$web.ResetRoleInheritance()
$web.Update()
#Apply new perms as required
$spRole = new-object Microsoft.SharePoint.SPRoleAssignment([Microsoft.SharePoint.SPPrincipal]$userOrGroup)
$spRole.RoleDefinitionBindings.Add($web.RoleDefinitions["Your Perm Level"])
$web.RoleAssignments.Add($spRole)

This should get you started anyway.