14

I have written a script that created a document library called "Audit Logs" for every site collection in our environment. I then wanted to ensure that only Site Collection administrators and the individual site Owners group had access to this document library. I was able to write a script to break the inheritance, allowing only the site collection administrators to view the library.

I was told after the fact that I also needed to make sure the the Owners group was able to access the Audit logs as well.

Here is what I have so far:

$site = Get-SPSite | Get-SPWeb -limit all | ForEach-Object {
$listName = "Audit Logs"


$list = $_.Lists[$listName]
$list.BreakRoleInheritance($False)

$list.Update()
}

How do I add the Owners group to the ACL for each of the Audit Log folders? I have seen various methods for adding individual user accounts, but not for a group.

I am using powershell and Sharepoint 2010 Enterprise.

Thanks in advance!

19

This script should do the trick after few adjustments as its adding new permissions to group which you don't want so you can skip them.

function Add-SPPermissionToListGroup
{
    param ($Url, $ListName, $GroupName, $PermissionLevel)
    $web = Get-SPWeb -Identity $Url
    $list = $web.Lists.TryGetList($ListName)
    if ($list -ne $null)
    {
        // Ensure that the permissions are not being inherited.
        if ($list.HasUniqueRoleAssignments -eq $False)
        {
            $list.BreakRoleInheritance($True)
        }

        // Modify the permissions.
        if ($web.SiteGroups[$GroupName] -ne $null)
        {
            $group = $web.SiteGroups[$GroupName]
            $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($group)
            $roleDefinition = $web.RoleDefinitions[$PermissionLevel];
            $roleAssignment.RoleDefinitionBindings.Add($roleDefinition);
            $list.RoleAssignments.Add($roleAssignment)
            $list.Update();
            Write-Host "Successfully added $PermissionLevel permission to $GroupName group in $ListName list. " -foregroundcolor Green
        }
        else
        {
            Write-Host "Group $GroupName does not exist." -foregroundcolor Red
        }

    }
    $web.Dispose()
}

Source

  • Thank you! This has given me a good idea how to work out my solution! – Kevin Jan 30 '13 at 16:44
  • 2
    if ($list.HasUniqueRoleAssignments -eq $False) { ... } else { ... } - why? With your code, if the list inherits permissions, you will break the inheritance and abort the operation. Why abort it? – hyankov Jul 13 '15 at 16:28
  • how can i apply the permissions to a single user? if i try with a single user instead of group, it failed! $musername ="domain1\\muser1" , when i tried with this, it throws error – userAZLogicApps Jun 23 '17 at 14:57
  • > new-object : A constructor was not found. Cannot find an appropriate constructor for type Microsoft.SharePoint.SPRoleAssignment. At E:\PoCSolutions\BreakRoleInheritance_HISTORY1List.ps1:30 char:31 + $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($ + + CategoryInfo : ObjectNotFound: (:) [New-Object], PSArgumentException + FullyQualifiedErrorId : annotFindAppropriateCtor,Microsoft.PowerShell.Commands.NewObjectCommand – userAZLogicApps Jun 23 '17 at 14:58
4

Just an addendum to this as I came across this post while researching an issue we were having, if you call $List.Update() right after the RoleAssignments.Add(), you may hit a race condition and it'll report a save conflict on the $List item.

it will however update the RoleAssignment as the .Add commits the change without the need to call .Update() on the list.

Paul.

  • I think this has been an issue with CSOM managed code as well. I had these kind of errors (in less than 1% of cases) 4-5 months back, however did not know enough of SharePoint to find the root cause at that time. Maybe I still don't know enough. Any chance there are any references/documentation for this issue? – Nisarg Apr 10 '16 at 15:27
0

Thanks, TimeToShine. I appreciate you posting that script, it definitely helped get me to where I needed to be. Here was my final script:

if ( -not $(Get-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction "SilentlyContinue" )) {Add-PSSnapin Microsoft.SharePoint.PowerShell}

$sites = Get-SPSite | Select RootWeb, URL

foreach ($site in $sites){

$ListName = "Audit Logs"
$PermissionLevel = "Full Control"
$web = $site.rootweb
#$web = Get-SpSite -identity $site.url
#$web = Get-SPWeb -Identity $site.url        
$list = $web.Lists | where {$_.Title -match $ListName}
    if ($list -ne $null)
    {
        if ($list.HasUniqueRoleAssignments -eq $False)
        {$list.BreakRoleInheritance($True)}

        if ($list.HasUniqueRoleAssignments -eq $True)
        {
            ForEach ($SiteGroup in $web.SiteGroups) {                    

                if ($SiteGroup.Name -match "Owners")
                {
                    #write-host $SiteGroup.Name
                    $GroupName = $SiteGroup.Name
                    $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($SiteGroup)
                    $roleDefinition = $web.RoleDefinitions[$PermissionLevel];
                    $roleAssignment.RoleDefinitionBindings.Add($roleDefinition);
                    $list.RoleAssignments.Add($roleAssignment)
                    $list.Update();
                    Write-Host "Successfully added <$GroupName> to the <$ListName> list in <$site>. " -foregroundcolor Green
                }                
                else
                {
                     Write-Host "No Owners groups exist." -foregroundcolor Red
                }
            }
            }
        }
    }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.