How can I change Document library permissions for all site collections using powershell?

Question

Total Powershell newbie here, but I have managed to write a couple scripts so far that have been working.

We are using 2010 Enterprise edition, and I have been tasked with creating a script that will add a new Document Library to every site collection....No problem, got that one created. But the kicker on this was that they want the document library to be hidden from all users except for Site Collection Administrators.

I have searched for 2 days straight (Google isnt returning any blue links anymore, just purple haha) and have not been able to find the answer.

Could anybody help me out with this? What do I add to this script to make the new Libraries hidden from everyone except site collection admins?

this is what I have to create the libraries:

$sites = get-spsite -webapplication http://portal -limit all
foreach($site in $sites)
{
$spWeb = Get-SPWeb $site.url
$listTemplate = [Microsoft.sharepoint.SPListTemplateType]::DocumentLibrary
$spWeb.Lists.Add("Audits","Location for storage of Audit Files",$listTemplate)
}

Answer 1

$spSites = Get-Spweb -Limit All
foreach ($SPsite in $spSites)
{
   $webUrl= $SPsite.url
   $listTemplate = [Microsoft.sharepoint.SPListTemplateType]::DocumentLibrary
   $spWeb.Lists.Add("Audits","Location for storage of Audit Files",$listTemplate)
   $spList="Audits"
   $spWeb = ([Microsoft.SharePoint.PowerShell.SPWebPipeBind]$webUrl).Read()
   $spList =  $spWeb.Lists[$spList]
   $spList.BreakRoleInheritance("true");
   $spweb.AllowUnsafeupdates = $true
   [Microsoft.SharePoint.SPRoleAssignmentCollection] $spRoleAssignments = $spList.RoleAssignments
  for([int] $a = $spRoleAssignments.Count-1; $a -ge 0; $a--)
         {

            $spRoleAssignments.Remove($a);

         }
    $spweb.AllowUnsafeupdates = $false
    $spWeb.Dispose()
}

Answer 2

Wanted to thank the folks who wrote replies for this question. I had decided to do my tasks in separate scripts, for the sake of making things easier.

I ended up using this as my final script to break the permissions on the document libraries. I have tested it out in my dev environment extensively, and all seems to be working well. The script calls out every site collection, looks for a document library called "Audit Logs" (which is created in a previous script), and then breaks the permissions from the parent folder, which in turn leaves only the Site Collection Administrators with access to the library. When regular users browse the site, the folder doesnt even show up in their view. All is right in the world.

Again, thanks for the help guys.

$site = Get-SPSite | Get-SPWeb -limit all | ForEach-Object {
$listName = "Audit Logs"
$list = $_.Lists[$listName]
$list.BreakRoleInheritance($False)
$list.Update()
}

Answer 3

You need to break inheritance to the list as soon as your create it. Because site collection administrators can see everything in the site collection, you shouldn't have to add there roles to the library. Try something like this:

$sites = get-spsite -webapplication http://portal -limit all
foreach($site in $sites)
{
$spWeb = Get-SPWeb $site.url
$listTemplate = [Microsoft.sharepoint.SPListTemplateType]::DocumentLibrary
$spWeb.Lists.Add("Audits","Location for storage of Audit Files",$listTemplate)
$docLib = $SpSite.Lists["Audits"];
$docLib.BreakRoleInheritance("false");
    while ($docLib.RoleAssignments.Count > 0)  
    { 
      $docLib.RoleAssignments.Remove(0); 
    }
}