0

We would like to setup a tool to help us on the below listed activities and dont expect any additional features, the tool should be cost effective as we have 2wfes with less than 4k users.

  • Manage Permission Inheritance
  • Find unique permission items
  • Copy user permissions
  • Transfer user permissions
  • Delete Permissions
  • Clean up old user accounts
  • Discover Permissions against the Farm, Web Application and Site Collection
  • List and List Item broken permission inheritance report
  • Permission reports
  • Permission Audit(optional)

Our consideration is

  • Deliverpoint
  • Quest Site Administrator for SharePoint
  • Axceler Controlpoint

and its license details..

Improve this question
5
  • 1
    Please rephrase this to get a more directed answer. All of these products do what you want, some give additional benefits. As it is, this is overly opinion based.
    – Eric Alexander
    Nov 21, 2013 at 22:31
  • have updated the question, please have a look...
    – Karthikeyan
    Nov 22, 2013 at 1:11
  • @PirateEric, request you to unhold this as I have updated the question as per your suggestion, please let me know if still you feel something is missing..I'm really depend on the experts suggestions.
    – Karthikeyan
    Nov 22, 2013 at 17:27
  • Are you asking for a commercial tool or a open source tool? Any answer referencing a commercial tool will get moderator attention since commercial tools are off topic for this site. This question is on the fine line between open and closed.
    – Benny Skogberg ♦
    Nov 22, 2013 at 20:04
  • Ideally, I would like to go with free tools or with Powershell however we could not find any of such..and started looking for the paid once..
    – Karthikeyan
    Nov 23, 2013 at 0:12

2 Answers 2

Reset to default
3

I'd suggest using PowerShell with SharePoint - there are tools, code libraries and a good book out there which could cover most of your requirements (& it'll be much cheaper too) :

Windows PowerShell for SharePoint Command Builder

SharePoint Management PowerShell scripts (CodePlex)

Automating SharePoint 2010 with Windows PowerShell 2.0 (book)

Improve this answer
1
0

My contribution to the community

########################################################################
# Generated On: 12/12/2013 3:45 PM
# Generated By: Karthikeyan Vijayakumar
########################################################################

#Generated check Web Permission
function Get-SPUserEffectivePermissions(
    [string]$user, 
    [Microsoft.SharePoint.SPSecurableObject]$InputObject) {

    begin {
        # Determine the URL to the securable object being evaluated
        $parentWeb = $null
    }
    process {
        $so = $InputObject

        if ($so -eq $null) { $so = $_ }

        if ($so -isnot [Microsoft.SharePoint.SPSecurableObject]) {
            throw "A valid SPWeb, SPList, or SPListItem must be provided."
        }

        if ($so -is [Microsoft.SharePoint.SPWeb]) {
            $parentWeb = $so
        } elseif ($so -is [Microsoft.SharePoint.SPList]) {
            $parentWeb = $so.ParentWeb
        } elseif ($so -is [Microsoft.SharePoint.SPListItem]) {
            $parentWeb = $so.ParentList.ParentWeb
        }

        if($parentWeb -ne $null) {
        [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges({
            $spUser = $parentWeb.EnsureUser($user);

            if($spUser -ne $null) {

                # Get the users group details.
                $spUserGroups = $spUser.Groups;
                $spUserGroups |% {
                    $webGroup = $_;
                    $webGroupName = $webGroup.Name;
                    $webGroupRole = $webGroup.Roles |% {$_.Name + ","} | out-string
                    $newRow = @( $parentWeb.Url, $webGroupName , $webGroupRole )
                    $dataGridView1.Rows.Add($newRow)     
                }

                # Get the users permission details.
                $permInfo = $spUser.Roles                

                # Iterate through them
                if ($permInfo.Count -gt 0) {
                    for($i=0; $i -lt $permInfo.Count; $i++) {
                        $permName = $permInfo[$i].Name
                        $permRoles = "`t"
                        #$permRoles = "Direct"
                        #$permRoles = $permInfo[$i].Type

                        if ($permName -ne "Limited Access") {
                           $newRow = @( $parentWeb.Url, $permRoles , $permName )
                           $dataGridView1.Rows.Add($newRow)
                        }
                        else {
                           checkListPermissions $parentWeb $spUser
                        } 
                    }
                }
            }
       });
       }
    }
    end {
        if($parentWeb -ne $null) {
           $parentWeb.Dispose(); 
        }
    }
}

#Generated check List Permission
function checkListPermissions($web, $spUser) {
    begin {
    }
    process {
        [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges({
        $web.Lists |% {
            $spList = $_;
            if($spList.HasUniqueRoleAssignments) {
                $spUserRoles= $spList.RoleAssignments |? {$_.Member -like $spUser.LoginName} 
                    if($spUserRoles -ne $null) {                
                        $spUserRoleBindings = ($spUserRoles | select RoleDefinitionBindings).RoleDefinitionBindings |% {$_.Name + ","} | out-string
                        $newRow = @( ($web.Site.Url + $spList.DefaultViewUrl ), $spList.Title, $spUserRoleBindings )
                        $dataGridView1.Rows.Add($newRow)                      
                    }
            }
        }
        });
    }
    end {
    }
}

#Generated Remove Web Permission
function Remove-SPUserEffectivePermissions(
    [string]$user, 
    [Microsoft.SharePoint.SPSecurableObject]$InputObject) {

    begin {
        # Determine the URL to the securable object being evaluated
        $parentWeb = $null
    }
    process {
        $so = $InputObject
        if ($so -eq $null) { $so = $_ }

        if ($so -isnot [Microsoft.SharePoint.SPSecurableObject]) {
            throw "A valid SPWeb, SPList, or SPListItem must be provided."
        }

        if ($so -is [Microsoft.SharePoint.SPWeb]) {
            $parentWeb = $so
        } elseif ($so -is [Microsoft.SharePoint.SPList]) {
            $parentWeb = $so.ParentWeb
        } elseif ($so -is [Microsoft.SharePoint.SPListItem]) {
            $parentWeb = $so.ParentList.ParentWeb
        }

        if($parentWeb -ne $null) {
        [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges({
            $spUser = $parentWeb.EnsureUser($user);

            if($spUser -ne $null) {
                $answer= [System.Windows.Forms.MessageBox]::Show("Are you sure do you want to remove the permission of - $($spUser.DisplayName)" , "Status" , 4)
                if ($answer -eq "YES" ) {
                    # Get the users group details and remove.
                    $spUserGroups = $spUser.Groups;
                    $spUserGroups |% {
                        $webGroup = $_;
                        $webGroup.RemoveUser($spUser);  
                    }

                    # Remove the user roles.
                    $parentWeb.RoleAssignments.Remove($spUser);
                    $parentWeb.Update();                    
                    #Notify the Administrator
                    [System.Windows.Forms.MessageBox]::Show("User permission have been removed..!" , "Status");
                }                        
                else {
                    #Notify the Administrator
                    [System.Windows.Forms.MessageBox]::Show("Action has been cancelled by the Administrator..!" , "Status");
                }            
            }
            else {
                #Notify the Administrator
                [System.Windows.Forms.MessageBox]::Show("User not found..!" , "Status");
            }
       });
       }
    }
    end {
        $dataGridView1.Rows.Clear();
        if($parentWeb -ne $null) {
           $parentWeb.Dispose(); 
        }
    }
}

#Generated check Web Permission
function Copy-SPUserEffectivePermissions(
    [string]$user, 
    [string]$userTarget,
    [Microsoft.SharePoint.SPSecurableObject]$InputObject) {

    begin {
        # Determine the URL to the securable object being evaluated
        $parentWeb = $null
    }
    process {
        $so = $InputObject
        if ($so -eq $null) { $so = $_ }

        if ($so -isnot [Microsoft.SharePoint.SPSecurableObject]) {
            throw "A valid SPWeb, SPList, or SPListItem must be provided."
        }

        if ($so -is [Microsoft.SharePoint.SPWeb]) {
            $parentWeb = $so
        } elseif ($so -is [Microsoft.SharePoint.SPList]) {
            $parentWeb = $so.ParentWeb
        } elseif ($so -is [Microsoft.SharePoint.SPListItem]) {
            $parentWeb = $so.ParentList.ParentWeb
        }

        if($parentWeb -ne $null) {
        [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges({
            $spUser = $parentWeb.EnsureUser($user);
            $spUserTarget = $parentWeb.EnsureUser($userTarget);

            #Check if the Target user exists
            if($spUserTarget -ne $null ) {

                #Check if the Source user exists
                if($spUser -ne $null ) {

                    # Get the users group details.
                    $spUserGroups = $spUser.Groups;
                    $spUserGroups |% {
                        $webGroup = $_;
                        $webGroup.AddUser($spUserTarget);
                    }

                    # Get the users permission details.
                    $permInfo = $spUser.Roles

                    # Iterate through them
                    $permInfo |% {
                        $permName = $_.Name;

                        if($permName -ne "Limited Access") {
                            $_.AddUser($spUserTarget);
                        }
                        else {
                            setListPermissions $parentWeb $spUser $spUserTarget
                        }
                    }
                    #Notify the Administrator
                    [System.Windows.Forms.MessageBox]::Show("Permission has been copied..!" , "Status");
                }
                else {
                    #Notify the Administrator
                    [System.Windows.Forms.MessageBox]::Show("Source User does not exist..!" , "Status");
                }            
            }
            else {
                #Notify the Administrator
                [System.Windows.Forms.MessageBox]::Show("Target User does not exist..!" , "Status");            
            }
        });
        }
    }
    end {
        if($parentWeb -ne $null) {
            $parentWeb.Dispose();
        }
    }
}

#Generated check List Permission
function setListPermissions($web, $spUser, $spUserTarget) {
    begin {
    }
    process {
    [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges({
        $web.Lists |% {
            $spList = $_;
            if($spList.HasUniqueRoleAssignments) {
                $spUserRoles= $spList.RoleAssignments |? {$_.Member -like $spUser.LoginName}
                if($spUserRoles -ne $null) {
                    $roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($spUserTarget)
                    $spUserRoleBindings = ($spUserRoles | select RoleDefinitionBindings).RoleDefinitionBindings

                    $spUserRoleBindings |% {
                        $roleAssignment.RoleDefinitionBindings.Add($_)
                        $list.RoleAssignments.Add($roleAssignment)
                        $list.Update();                    
                    }
                }
            }
        }
    });
    }
    end {
    }
}

#Generated Form Function
function GenerateForm {
#region Import the Assemblies
[reflection.assembly]::loadwithpartialname("System.Drawing") | Out-Null
[reflection.assembly]::loadwithpartialname("System.Windows.Forms") | Out-Null
#endregion

#region Generated Form Objects
$form1 = New-Object System.Windows.Forms.Form
$label4 = New-Object System.Windows.Forms.Label
$global:txtTargerUserLoginName = New-Object System.Windows.Forms.TextBox
$label3 = New-Object System.Windows.Forms.Label
$btnRemovePermision = New-Object System.Windows.Forms.Button
$btnCopyPermission = New-Object System.Windows.Forms.Button
$global:dataGridView1 = New-Object System.Windows.Forms.DataGridView
$btnClear = New-Object System.Windows.Forms.Button
$btnGetPermisison = New-Object System.Windows.Forms.Button
$global:txtUserLoginName = New-Object System.Windows.Forms.TextBox
$label2 = New-Object System.Windows.Forms.Label
$global:txtWebURL = New-Object System.Windows.Forms.TextBox
$label1 = New-Object System.Windows.Forms.Label
$InitialFormWindowState = New-Object System.Windows.Forms.FormWindowState
#endregion Generated Form Objects

#----------------------------------------------
#Generated Event Script Blocks
#----------------------------------------------
#Provide Custom Code for events specified in the Form.
$btnRemovePermision_OnClick= 
{
    Get-SPWeb $txtWebURL.Text | Remove-SPUserEffectivePermissions $txtUserLoginName.Text
}

$btnCopyPermission_OnClick= 
{
    Get-SPWeb $txtWebURL.Text | Copy-SPUserEffectivePermissions $txtUserLoginName.Text $txtTargerUserLoginName.Text
}

$handler_form1_Load= 
{
    $dataGridView1.ColumnCount = 3
    $dataGridView1.ColumnHeadersVisible = $true
    $dataGridView1.Columns[0].Name = "Web URL"
    $dataGridView1.Columns[1].Name = "Group Name"
    $dataGridView1.Columns[2].Name = "Permission Level"

    $dataGridView1.Columns[0].width = 300
    $dataGridView1.Columns[1].width = 138
    $dataGridView1.Columns[2].width = 260
}

$btnClear_OnClick= 
{
    clearForm
}

$btnGetPermisison_OnClick= 
{
    $dataGridView1.Rows.Clear();
    Get-SPWeb $txtWebURL.Text | Get-SPUserEffectivePermissions $txtUserLoginName.Text
}

$OnLoadForm_StateCorrection=
{
    #Correct the initial state of the form to prevent the .Net maximized form issue
    $form1.WindowState = $InitialFormWindowState
}

#----------------------------------------------
#region Generated Form Code
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 597
$System_Drawing_Size.Width = 796
$form1.ClientSize = $System_Drawing_Size
$form1.DataBindings.DefaultDataSourceUpdateMode = 0
$form1.Name = "frmSPMgr"
$form1.Text = "SharePoint User Permission Manager"
$form1.add_Load($handler_form1_Load)

$label4.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 218
$System_Drawing_Point.Y = 562
$label4.Location = $System_Drawing_Point
$label4.Name = "label4"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 23
$System_Drawing_Size.Width = 287
$label4.Size = $System_Drawing_Size
$label4.TabIndex = 11
$label4.Text = "This Application is designed by Karthikeyan Vijayakumar @2013."

$form1.Controls.Add($label4)

$txtTargerUserLoginName.DataBindings.DefaultDataSourceUpdateMode = 0
$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 189
$System_Drawing_Point.Y = 101
$txtTargerUserLoginName.Location = $System_Drawing_Point
$txtTargerUserLoginName.Name = "txtTargerUserLoginName"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 20
$System_Drawing_Size.Width = 573
$txtTargerUserLoginName.Size = $System_Drawing_Size
$txtTargerUserLoginName.TabIndex = 10

$form1.Controls.Add($txtTargerUserLoginName)

$label3.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 30
$System_Drawing_Point.Y = 101
$label3.Location = $System_Drawing_Point
$label3.Name = "label3"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 23
$System_Drawing_Size.Width = 212
$label3.Size = $System_Drawing_Size
$label3.TabIndex = 9
$label3.Text = "Email Address of Target User"

$form1.Controls.Add($label3)


$btnRemovePermision.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 478
$System_Drawing_Point.Y = 139
$btnRemovePermision.Location = $System_Drawing_Point
$btnRemovePermision.Name = "btnRemovePermision"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 23
$System_Drawing_Size.Width = 108
$btnRemovePermision.Size = $System_Drawing_Size
$btnRemovePermision.TabIndex = 8
$btnRemovePermision.Text = "Remove Permision"
$btnRemovePermision.UseVisualStyleBackColor = $True
$btnRemovePermision.add_Click($btnRemovePermision_OnClick)

$form1.Controls.Add($btnRemovePermision)


$btnCopyPermission.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 372
$System_Drawing_Point.Y = 139
$btnCopyPermission.Location = $System_Drawing_Point
$btnCopyPermission.Name = "btnCopyPermission"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 23
$System_Drawing_Size.Width = 99
$btnCopyPermission.Size = $System_Drawing_Size
$btnCopyPermission.TabIndex = 7
$btnCopyPermission.Text = "Copy Permission"
$btnCopyPermission.UseVisualStyleBackColor = $True
$btnCopyPermission.add_Click($btnCopyPermission_OnClick)

$form1.Controls.Add($btnCopyPermission)

$dataGridView1.DataBindings.DefaultDataSourceUpdateMode = 0
$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 30
$System_Drawing_Point.Y = 181
$dataGridView1.Location = $System_Drawing_Point
$dataGridView1.Name = "dataGridView1"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 351
$System_Drawing_Size.Width = 741
$dataGridView1.Size = $System_Drawing_Size
$dataGridView1.TabIndex = 6

$form1.Controls.Add($dataGridView1)


$btnClear.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 190
$System_Drawing_Point.Y = 139
$btnClear.Location = $System_Drawing_Point
$btnClear.Name = "btnClear"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 23
$System_Drawing_Size.Width = 75
$btnClear.Size = $System_Drawing_Size
$btnClear.TabIndex = 5
$btnClear.Text = "Clear"
$btnClear.UseVisualStyleBackColor = $True
$btnClear.add_Click($btnClear_OnClick)

$form1.Controls.Add($btnClear)


$btnGetPermisison.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 271
$System_Drawing_Point.Y = 139
$btnGetPermisison.Location = $System_Drawing_Point
$btnGetPermisison.Name = "btnGetPermisison"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 23
$System_Drawing_Size.Width = 95
$btnGetPermisison.Size = $System_Drawing_Size
$btnGetPermisison.TabIndex = 4
$btnGetPermisison.Text = "Get Permision"
$btnGetPermisison.UseVisualStyleBackColor = $True
$btnGetPermisison.add_Click($btnGetPermisison_OnClick)

$form1.Controls.Add($btnGetPermisison)

$txtUserLoginName.DataBindings.DefaultDataSourceUpdateMode = 0
$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 188
$System_Drawing_Point.Y = 63
$txtUserLoginName.Location = $System_Drawing_Point
$txtUserLoginName.Name = "txtUserLoginName"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 20
$System_Drawing_Size.Width = 574
$txtUserLoginName.Size = $System_Drawing_Size
$txtUserLoginName.TabIndex = 3

$form1.Controls.Add($txtUserLoginName)

$label2.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 30
$System_Drawing_Point.Y = 63
$label2.Location = $System_Drawing_Point
$label2.Name = "label2"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 23
$System_Drawing_Size.Width = 152
$label2.Size = $System_Drawing_Size
$label2.TabIndex = 2
$label2.Text = "Email Address of the User"

$form1.Controls.Add($label2)

$txtWebURL.DataBindings.DefaultDataSourceUpdateMode = 0
$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 188
$System_Drawing_Point.Y = 27
$txtWebURL.Location = $System_Drawing_Point
$txtWebURL.Name = "txtWebURL"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 20
$System_Drawing_Size.Width = 574
$txtWebURL.Size = $System_Drawing_Size
$txtWebURL.TabIndex = 1

$form1.Controls.Add($txtWebURL)

$label1.DataBindings.DefaultDataSourceUpdateMode = 0

$System_Drawing_Point = New-Object System.Drawing.Point
$System_Drawing_Point.X = 30
$System_Drawing_Point.Y = 30
$label1.Location = $System_Drawing_Point
$label1.Name = "label1"
$System_Drawing_Size = New-Object System.Drawing.Size
$System_Drawing_Size.Height = 18
$System_Drawing_Size.Width = 131
$label1.Size = $System_Drawing_Size
$label1.TabIndex = 0
$label1.Text = "Enter the Web URL"

$form1.Controls.Add($label1)

#endregion Generated Form Code

#Save the initial state of the form
$InitialFormWindowState = $form1.WindowState
#Init the OnLoad event to correct the initial state of the form
$form1.add_Load($OnLoadForm_StateCorrection)
#Show the Form
$form1.ShowDialog()| Out-Null

} #End Function

function clearForm {
    $txtWebURL.Text = "";
    $txtUserLoginName.Text = "";
    $txtTargerUserLoginName.Text = "";
    $dataGridView1.Rows.Clear();
}

#Call the Function
GenerateForm
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.