I've inherited a site collection that has 20,000+ subsites. I cannot connect any management tools to it like Metalogix or ShareGate and I've been told PowerShell will fix it.

I hope to batch the jobs into runs of around 500 with the batch of 500 subsites being loaded from a reference file like a CSV.

I've been told the commands required can only run server side and that to run against 500 sites in a batch, the entire site collection permissions would need to be loaded in each time. Is this correct, it sounds very inefficient.

A little more info. Each subsite uses between 3-5 AD groups to set permissions at its root. Each AD group is set a custom permission level. I'm presuming PowerShell can also manipulate permission levels when adding AD groups?


1 Answer 1


Don't know why you would need to batch it but you could quickly test it to see if you can return that number of sites:

$site = Get-SPSite http://sharepoint/sites/yoursite
$webs = $site.AllWebs

If that completes without error and you can see all the webs in $webs then you really don't need to batch the operation. You could run client side commands if you need to (even web services) but this will probably be easier server side.

You can change permission levels as required but if I were you I would do something like:

#Reset any custom permissions:
#Apply new perms as required
$spRole = new-object Microsoft.SharePoint.SPRoleAssignment([Microsoft.SharePoint.SPPrincipal]$userOrGroup)
$spRole.RoleDefinitionBindings.Add($web.RoleDefinitions["Your Perm Level"])

This should get you started anyway.

  • Thank you for the reply. I can load in all 26000 subsites using PS. What I've been told is that it will take days if not weeks to change the permissions and even if it was batched in sites 0-500, 501-1000 etc it would still take a long time to find AD group A and replace with AD group B. Or in my case I need to find if AD group A is present and add AD group B to the site, leaving AD group present.
    – Darrel
    Commented Sep 27, 2017 at 10:08
  • How long did it take to get the 26k sites? I have pushed out permission changes across several hundred site collections with about 10k total sites overnight. Unless your SharePoint farm is under-powered it should easily be doable in a weekend if not a day. I'll edit my answer to show how to check for an existing group. If you need further help with a script feel free to post what you have and ping me.
    – Bunzab
    Commented Sep 27, 2017 at 10:42
  • I don't appear to be able to use get-spsite but get-subsite appears to run for under a minute and gives the impression it's whizzing through the subsites $site = Connect-Site -Url yoursharepointsite.com/etc Get-Subsite -Site $site
    – Darrel
    Commented Sep 27, 2017 at 11:26
  • I'l assume by that you are using Sharegate? I also assume you are doing this remotely and not on the SharePoint box? Remotely you need to use the Client Side Object Model and the snippets I posted above will not work.
    – Bunzab
    Commented Sep 27, 2017 at 14:09
  • Correct. ShareGate and remote. I do have access to a dev server so it's possible to do something resembling a POC on something smaller than our production monster.
    – Darrel
    Commented Sep 27, 2017 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.