Add group to Library permissions using powershell

Question

I have written a script that created a document library called "Audit Logs" for every site collection in our environment. I then wanted to ensure that only Site Collection administrators and the individual site Owners group had access to this document library. I was able to write a script to break the inheritance, allowing only the site collection administrators to view the library.

I was told after the fact that I also needed to make sure the the Owners group was able to access the Audit logs as well.

Here is what I have so far:

$site = Get-SPSite | Get-SPWeb -limit all | ForEach-Object {
$listName = "Audit Logs"


$list = $_.Lists[$listName]
$list.BreakRoleInheritance($False)

$list.Update()
}

How do I add the Owners group to the ACL for each of the Audit Log folders? I have seen various methods for adding individual user accounts, but not for a group.

I am using powershell and Sharepoint 2010 Enterprise.

Thanks in advance!

Answer 1

This script should do the trick after few adjustments as its adding new permissions to group which you don't want so you can skip them.

function Add-SPPermissionToListGroup
{
    param ($Url, $ListName, $GroupName, $PermissionLevel)
    $web = Get-SPWeb -Identity $Url
    $list = $web.Lists.TryGetList($ListName)
    if ($list -ne $null)
    {
        // Ensure that the permissions are not being inherited.
        if ($list.HasUniqueRoleAssignments -eq $False)
        {
            $list.BreakRoleInheritance($True)
        }

        // Modify the permissions.
        if ($web.SiteGroups[$GroupName] -ne $null)
        {
            $group = $web.SiteGroups[$GroupName]
            $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($group)
            $roleDefinition = $web.RoleDefinitions[$PermissionLevel];
            $roleAssignment.RoleDefinitionBindings.Add($roleDefinition);
            $list.RoleAssignments.Add($roleAssignment)
            $list.Update();
            Write-Host "Successfully added $PermissionLevel permission to $GroupName group in $ListName list. " -foregroundcolor Green
        }
        else
        {
            Write-Host "Group $GroupName does not exist." -foregroundcolor Red
        }

    }
    $web.Dispose()
}

Source

Answer 2

Just an addendum to this as I came across this post while researching an issue we were having, if you call $List.Update() right after the RoleAssignments.Add(), you may hit a race condition and it'll report a save conflict on the $List item.

it will however update the RoleAssignment as the .Add commits the change without the need to call .Update() on the list.

Paul.

Answer 3

Thanks, TimeToShine. I appreciate you posting that script, it definitely helped get me to where I needed to be. Here was my final script:

if ( -not $(Get-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction "SilentlyContinue" )) {Add-PSSnapin Microsoft.SharePoint.PowerShell}

$sites = Get-SPSite | Select RootWeb, URL

foreach ($site in $sites){

$ListName = "Audit Logs"
$PermissionLevel = "Full Control"
$web = $site.rootweb
#$web = Get-SpSite -identity $site.url
#$web = Get-SPWeb -Identity $site.url        
$list = $web.Lists | where {$_.Title -match $ListName}
    if ($list -ne $null)
    {
        if ($list.HasUniqueRoleAssignments -eq $False)
        {$list.BreakRoleInheritance($True)}

        if ($list.HasUniqueRoleAssignments -eq $True)
        {
            ForEach ($SiteGroup in $web.SiteGroups) {                    

                if ($SiteGroup.Name -match "Owners")
                {
                    #write-host $SiteGroup.Name
                    $GroupName = $SiteGroup.Name
                    $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($SiteGroup)
                    $roleDefinition = $web.RoleDefinitions[$PermissionLevel];
                    $roleAssignment.RoleDefinitionBindings.Add($roleDefinition);
                    $list.RoleAssignments.Add($roleAssignment)
                    $list.Update();
                    Write-Host "Successfully added <$GroupName> to the <$ListName> list in <$site>. " -foregroundcolor Green
                }                
                else
                {
                     Write-Host "No Owners groups exist." -foregroundcolor Red
                }
            }
            }
        }
    }