I have a web application with multiple site collections created on it (45 in total). I need to determine how many users with permissions (any permission) exist on site collection.

I am looking for something like this:

enter image description here


I tried the below code:

 $web= Get-SPWebApplication http://weburl

foreach($site in $sites){

$siteUsers = $web.SiteUsers
Write-Host "Users count for" $web.Title  "is" $siteUsers.Count


the output is like this:

Users count for Site Collection A is 66

Users count for Site Collection B is 125

Users count for Site Collection C is 52

But I believe the above numbers are huge, they should be less than that.

Any help is appreciated.

  • How complex is your environment? How deep do you need to dig? Can sites, subsites, libraries, files have different users? How are the permissions set? Directly to users or with groups? – vilmarci Mar 28 '18 at 9:43
  • basically I have site collection admins and site owners, so I want to know the total number of users with priviliges for each site collection whether they are site collection admins or site owners. – Mohammad Akilan Mar 28 '18 at 9:46
  • I have tried the below: it's working, but not sure about it, as it gives huge number of users $web= Get-SPWebApplication weburl $sites=$web.Sites foreach($site in $sites){ $web=$site.OpenWeb() $siteUsers = $web.SiteUsers Write-Host "Users count for" $web.Title "is" $siteUsers.Count } – Mohammad Akilan Mar 28 '18 at 9:49
  • This should be good, maybe you have a lot of users? List them instead of counting and randomly check their authorization. – vilmarci Mar 28 '18 at 10:38
  • Sorry I didnt get it – Mohammad Akilan Mar 28 '18 at 10:44

SiteUsers is not a good way to figure out who has access. There can be people in SiteUsers who do not have access, and there could be people who have access who are not found in SiteUsers.

Anyone who has ever been referenced within a site collection will have an entry in SiteUsers. Adding to a group, referencing them in a People field, or calling the EnsureUser method are a few ways this can happen. Also, once they're in there, they never leave, so a user could have their access revoked and could still be in there.

A better solution would be to iterate the site security groups, check for the permission level you're looking for, and looping through the users. But even this method is not foolproof; users added through Active Directory groups won't even be found there.

Technically you might be able to loop through Active Directory users but for a large organization this is going to be a practical improbability. And even so, by the time the code finishes it could be wrong; users can be added or removed at any time so the best you can hope for is a snapshot.

Now you're going down a rabbit hole. If I were given this requirement I would push back that it's not really possible unless the requirement includes the understanding that there will be holes.

  • Also, as @vilmarci notes in a comment above, broken inheritance is going to complicate matters even further. – Derek Gusoff Mar 29 '18 at 2:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.