1

How can I remove any user that is NOT in a security group in a site collection via powershell, in Sharepoint Server 2013? Currently, I can remove with my script any user in the default security groups (members,owners,visitors), but I could not find how to remove users that are outside any group. Mind you, I am not looking to remove a specific user, with providing credentials. I want to remove any user that is not in a group.

Thank you.

1

I'd take a look at this link. It has a script that should be adaptable to work for most permission-management situations.

Below is the adapted to remove permissions from every user in a specific site who is not in a group. If you need help explaining or need a different adaption, please let me know! But please be cautious when removing permissions like this on Production servers. Mass changes can sometimes lead to unexpected results.

If you want to do every site instead of one at a time you can make a change like

$WebApplications = Get-SPWebApplication http://<Site Collecton> | Get-SPSite -Limit All | | Get-SPWeb -Limit All | % {...}
$sites = $webapp | Get-SPSite -Limit All
$webs =  $sites | Get-SPWeb -Limit All
$webs | % { 
    $_.Users | {...}
}

where the {...} is the indented code snippet below...

Add-PSSnapin "Microsoft.SharePoint.PowerShell" -ErrorAction SilentlyContinue

#Configuration parameters
$SiteURL="http://<Site Collection>/<Path>/<To>/<Site>"
$PermissionToRemove="ALL"
$Web = Get-SPWeb $SiteURL

$web.Users | % {
    $User = $web.EnsureUser($_)
    $RoleAssignment = $Web.RoleAssignments.GetAssignmentByPrincipal($User)

    $RemovePermissionRole = $web.RoleDefinitions[$PermissionToRemove]

    # Remove a specific permission from users outside groups
    if ($PermissionToRemove -and
        $PermissionToRemove -ne "ALL" -and 
        $RoleAssignment.RoleDefinitionBindings.Contains($RemovePermissionRole))
    {
        $RoleAssignment.RoleDefinitionBindings.Remove($RemovePermissionRole)
        Write-host "$($PermissionToRemove) permission removed from the User!"
    }

    # Remove all permissions from users outside groups
    elseif ($PermissionToRemove -eq "ALL")
    {
        $RoleAssignment.RoleDefinitionBindings.RemoveAll()
        Write-host "All permission removed from the User $($_.Name)!"
    }

    $RoleAssignment.Update()
}
  • 1
    Thank you very much for the effort you've put into amending the code for this answer. My test environment is down at the moment, but I will test the script as soon as I can. – Pavlos Parcharidis Nov 30 '18 at 16:46
  • @PavlosParcharidis It works on my 2013 servers, but I haven't tested the "every site" option. That part's mostly just a concept on how you could do each site. – KGlasier Nov 30 '18 at 18:18
  • 1
    Apologies for the delayed acceptance of the answer as solution, but our test environment had a serious issue and we just resolved it. I have tested your code and it works fine. Thank you very much for your assistance. – Pavlos Parcharidis Feb 8 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.