I have a need to check through a site collection and find all password protected office documents. My organisation has decided on a policy where password protection on documents will no longer be allowed and I've been given the task of finding them. Is there a way to do this in Powershell. I suspect it has something to do with the checking of file attributes but every example I have come across relates to reading from a network drive. Can this be done in sharepoint?


The solution below will work for encrypted files in Office 2007 and later OpenXML format. If you have Office 97-2003 or other format files you will need to add tests for these.

# Initialise variables
$SiteCollectionUrl = "http://yoursitecollectionurl"
$Logfile = "C:\logfile.txt"

# Create log file if it doesn't already exist
if(-not (Test-Path -path $Logfile)) {
    New-Item $Logfile -type file

Add-Content $LogFile "$(Get-Date)"

# Select all sites in the site collection
$SPWebs = Get-SPSite $SiteCollectionUrl | Get-SPWeb -Limit All

# Loop through the sites
foreach($Web in $SPWebs) {

    Write-Host "Subsite: $($Web.Title) at $($Web.Url)"

    # Select all non-hidden document libraries under the site
    $Libraries = $Web.Lists | Where-Object { $_.Hidden -eq $false -and $_.BaseType -eq "DocumentLibrary" }

    # Loop through the libraries that contain items
    foreach($Doclib in $Libraries | Where { $_.items.count -gt 0 }) {

        Write-Host "Library: $($Doclib.ParentWebUrl)/$($Doclib.Title)"

        # Loop through the library items (files)
        foreach($Item in $Doclib.items) {

            # Open the file and select first ~2kb
            $Binary = $Item.file.OpenBinary()
            $Start = [System.Text.Encoding]::Default.GetString($Binary[0000..2000])

            # Test for pattern indicating encrypted Office 2007/+ format file
            if($Start -match "E.n.c.r.y.p.t.e.d.P.a.c.k.a.g.e") {

                # Record encrypted file detection in log
                Add-Content $Logfile "-- Encrypted file: $($Doclib.ParentWebUrl)/$($Item.url)"

                # Uncomment lines below to delete file
                #Write-Host "-- Deleting encrypted file: $($Doclib.ParentWebUrl)/$($Item.url)"

  • 1
    Thanks spartanmouse works like a gem except you would need to include provision for doc sets as it bombs out when it encounters them with this error: You cannot call a method on a null-valued expression. At line:11 char:44 + $Binary = $Item.file.OpenBinary <<<< () + CategoryInfo : InvalidOperation: (OpenBinary:String) [], RuntimeException + FullyQualifiedErrorId : InvokeMethodOnNull – tonym Nov 2 '13 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.