Remove all users that are not in a security group via powershell

Question

How can I remove any user that is NOT in a security group in a site collection via powershell, in Sharepoint Server 2013? Currently, I can remove with my script any user in the default security groups (members,owners,visitors), but I could not find how to remove users that are outside any group. Mind you, I am not looking to remove a specific user, with providing credentials. I want to remove any user that is not in a group.

Thank you.

Answer 1

I'd take a look at this link. It has a script that should be adaptable to work for most permission-management situations.

Below is the adapted to remove permissions from every user in a specific site who is not in a group. If you need help explaining or need a different adaption, please let me know! But please be cautious when removing permissions like this on Production servers. Mass changes can sometimes lead to unexpected results.

If you want to do every site instead of one at a time you can make a change like

$WebApplications = Get-SPWebApplication http://<Site Collecton> | Get-SPSite -Limit All | | Get-SPWeb -Limit All | % {...}
$sites = $webapp | Get-SPSite -Limit All
$webs =  $sites | Get-SPWeb -Limit All
$webs | % { 
    $_.Users | {...}
}

where the {...} is the indented code snippet below...

Add-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue

#Configuration parameters
$SiteURL="http://<Site Collection>/<Path>/<To>/<Site>"
$PermissionToRemove="ALL"
$Web = Get-SPWeb $SiteURL

$web.Users | % {
    $User = $web.EnsureUser($_)
    $RoleAssignment = $Web.RoleAssignments.GetAssignmentByPrincipal($User)

    $RemovePermissionRole = $web.RoleDefinitions[$PermissionToRemove]

    # Remove a specific permission from users outside groups
    if ($PermissionToRemove -and
        $PermissionToRemove -ne "ALL" -and 
        $RoleAssignment.RoleDefinitionBindings.Contains($RemovePermissionRole))
    {
        $RoleAssignment.RoleDefinitionBindings.Remove($RemovePermissionRole)
        Write-host "$($PermissionToRemove) permission removed from the User!"
    }

    # Remove all permissions from users outside groups
    elseif ($PermissionToRemove -eq "ALL")
    {
        $RoleAssignment.RoleDefinitionBindings.RemoveAll()
        Write-host "All permission removed from the User $($_.Name)!"
    }

    $RoleAssignment.Update()
}