1

I was able to create a PowerShell script that creates a new permission level and assigns it to a group. However, I noticed that it doesn't replace the previous permission level of that group. So how can I create a script that removes the additional permission level of that group.

3

I found a script on the MSDN SharePoint forum that seems to have the answer. What I get from looking at the script is that it seems you have to remove the role definition for that permission level from the role definition bindings on the role assignments for the group. (Say that three times fast! ;)

Directly pulled from the link above:

function Remove-SPGroupPermission([Microsoft.SharePoint.SPGroup]$group, [string[]]$permissions) {
  $ra = $group.ParentWeb.RoleAssignments.GetAssignmentByPrincipal($group)
  foreach ($permission in $permissions) {
    $rd = $group.ParentWeb.RoleDefinitions[$permission]
    $ra.RoleDefinitionBindings.Remove($rd)
  }
  $ra.Update()
  $group.Update()
}

EDIT:

Ok, so what you want would probably look something like this, in a very simple form:

$web = get-spweb http://url/to/your/web
$group = $web.SiteGroups["Owners"]
$ra = $group.ParentWeb.RoleAssignments.GetAssignmentByPrincipal($group)
$rd = $group.ParentWeb.RoleDefinitions["Full Control"]
$ra.RoleDefinitionBindings.Remove($rd)
$ra.Update()
$group.Update()
$web.Dispose()

Or, if you wanted to use the function posted above, something like this:

function Remove-SPGroupPermission([Microsoft.SharePoint.SPGroup]$group, [string[]]$permissions) {
  $ra = $group.ParentWeb.RoleAssignments.GetAssignmentByPrincipal($group)
  foreach ($permission in $permissions) {
    $rd = $group.ParentWeb.RoleDefinitions[$permission]
    $ra.RoleDefinitionBindings.Remove($rd)
  }
  $ra.Update()
  $group.Update()
}

$web = get-spweb http://url/to/your/web
$group = $web.SiteGroups["Owners"]
$permissionsToRemove = @("Full Control")

Remove-SPGroupPermission -group $group -permissions $permissionsToRemove

$web.Dispose()
  • The above script will remove all permissions the group has. You'd then need to re-add any that you'd need. – NotVonKaiser Jun 6 '13 at 20:14
  • Well... won't it just remove all the permissions listed in the [string[]]$permissions parameter? And if that parameter happens to be an array of just one element, then it would only remove the one permission? – Dylan Cristy Jun 6 '13 at 20:24
  • Whoops, you're right. I completely missed that $permissions was a parameter of the function. – NotVonKaiser Jun 6 '13 at 20:26
  • Well, I'm having trouble getting it to work. Where in the script should I place the permission "Full Control" that I'm trying to remove and where would I place the group "Owners". How should it look like? – xIIx PEGA xIIx Jun 7 '13 at 14:27
  • I've edited my answer to show you what it should look like for your specific case. – Dylan Cristy Jun 7 '13 at 15:37
1

For SharePoint Online refer to: https://technet.microsoft.com/en-us/library/fp161387.aspx

Set-SPOSiteGroup -Site http://contoso.sharepoint.com/sites/siteA -Identity "ProjectViewers" -PermissionLevelsToRemove "Full Control" -PermissionLevelsToAdd "View Only"

Example 1 changes permission level of the ProjectViewers group inside site collection http://contoso.sharepoint.com/sites/siteA from Full Control to View Only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.