0

Via PNP/CMOS, we are looking to export all users that are of Full Control permission level in an on-premise site collection. This site collection could have 300+ sub-sites.

We are trying to figure out a way to export that information with all users that have Full Control in these 300+ sub-sites and use the export in Excel to then look at grouping options per users.

This whole experience is to begin site auditing, and for someone associated to multiple sub-sites with Full Control, we'd like to meet with them and address multiple sites in one setting if possible...rather than schedule multiple meetings.

So far, I'm trying via PowerShell on my box with CMOS and have a concept to at least show permissions on a list, but not seeing members for Web / $web on how to pull permissions + filter:

Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll" 
Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll" 

$siteUrl = "https://mysiteURL"  

$ctx = new-object Microsoft.SharePoint.Client.ClientContext($siteUrl)

$web = $ctx.Web
$list = $web.Lists.GetByTitle("GENERAL DOCUMENTS") 
#$ctx.Load($list)
$ctx.Load()

$ctx.ExecuteQuery()

$listroleassignments = $list.RoleAssignments
$ctx.Load($listroleassignments)
$ctx.ExecuteQuery()

foreach($listroleassgnment in $listroleassignments)
{
$ctx.Load($listroleassgnment.Member)
$ctx.Load($listroleassgnment.RoleDefinitionBindings)
$ctx.ExecuteQuery()

foreach($listroledefinition in $listroleassgnment.RoleDefinitionBindings)
{
$ctx.Load($listroledefinition)
$ctx.ExecuteQuery()
Write-Host -ForegroundColor Green $listroleassgnment.Member.Title: $listroledefinition.Name
}
}
0

here is created script for exporting all permissions, you can create filters inside the excel or add condition for only Full Control permissions. It's exported in CSV.

EDITED:

Here is script, you can add Items into and check UniquePermissions for logging. Better to do it in c#. This is PowerShell Example.

Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll" 
Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll" 
cls

$username = "user@company.onmicrosoft.com"
$password = ConvertTo-SecureString "pwd" -AsPlainText -Force

$siteUrl = [string]::Format("https://company.sharepoint.com")
$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($siteUrl)
$ctx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $password)

# Root Web
$Web = $ctx.Web
$ctx.Load($Web)
$WebRAs = $Web.RoleAssignments
$ctx.Load($WebRAs)
$ctx.ExecuteQuery()

Write-Host $Web.Url -ForegroundColor Cyan
foreach($WebRA in $WebRAs)
{
    $ctx.Load($WebRA.Member)
    $ctx.Load($WebRA.RoleDefinitionBindings)
    $ctx.ExecuteQuery()

    foreach($WebDB in $WebRA.RoleDefinitionBindings)
    {
        $ctx.Load($WebDB)
        $ctx.ExecuteQuery()
        Write-Host -ForegroundColor Green $WebRA.Member.Title: $WebDB.Name
    }
}

# Root Lists
$Lists = $Web.Lists
$ctx.Load($Lists)
$ctx.ExecuteQuery()

foreach($List in $Lists)
{
    $ctx.Load($List)
    Write-Host $List.Title -ForegroundColor Yellow
    $ListRAs = $List.RoleAssignments    
    $ctx.ExecuteQuery()
    $ctx.Load($ListRAs)
    $ctx.ExecuteQuery()

    foreach($ListRA in $ListRAs)
    {
        $ctx.Load($ListRA.Member)
        $ctx.Load($ListRA.RoleDefinitionBindings)
        $ctx.ExecuteQuery()

        foreach($ListRD in $ListRA.RoleDefinitionBindings)
        {
            $ctx.Load($ListRD)
            $ctx.ExecuteQuery()
            Write-Host -ForegroundColor Green $ListRA.Member.Title: $ListRD.Name
        }
    }

    #Items
}
  • Thank you for the comments. So far, I'm trying via PowerShell on my box with CMOS. Do you have an example using the Microsoft.SharePoint.Client.dll. I've updated my post above with latest script attempt. – Sol Web Solutions Jan 24 at 16:32
  • added script into my answer. – Zdeněk Vinduška Jan 24 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.