0

I have the following script, basically I need to iterate over all subsites with a specific template, and in one of the existing SP groups I want to remove a permission level.

The script below is throwing the exception principal not found.

 $webapplication =  Get-SPWebApplication  "http://xx.com"
    foreach($site in $webapplication.Sites)
    {         

        foreach($subWeb in $site.AllWebs)
        {  
            if($subWeb.AllProperties["WebTemplate"] -eq "Opportunity")
            {
                foreach($group in $subweb.SiteGroups)
                {                  
                    if($group.Name -Match "MAGroup")
                    {
                        Write-Host $subWeb.Url
                        Write-Host $group.Name 
                        $ra = $group.ParentWeb.RoleAssignments.GetAssignmentByPrincipal($group)
                        $rd = $group.RoleDefinitions["Contribute"]
                        $ra.RoleDefinitionBindings.Remove($rd)
                        $ra.Update()
                        $group.Update()
                        $subWeb.Dispose()
                    }
                }         

            } 
        }

        $site.Dispose()
    }
  • From what @NadeemYousef says, I'd say you probably want to create a 2nd group "MAGroup_NoContribute" or something and copy over the members and switch groups where he wants the reduced permission to take effect. You would have to make sure the group name is not something that's used in code, though. – Cameron Verhelst Apr 10 '14 at 6:13
  • Are you trying to remove the RoleDefinition Contribute from the site or are you trying to remove the any role assignment with Contribute Permission for that group? – sssreddy Apr 14 '14 at 18:54
1
+50

As Nadeem said, RoleDefinations are associated with SPWeb Object and not group.

instead of

$rd = $group.RoleDefinitions["Contribute"]

Try this

$rd = $group.ParentWeb.RoleDefinitions["Contribute"]
| improve this answer | |
2

RoleDefinitions are associated with SPWeb object not SPGroupas you have done in $rd = $group.RoleDefinitions["Contribute"]. Moreover, groups are created at root site collection level only and are used in sub sites. So, if you remove a permission from a group at one place like in root web, then the changes will be seen everywhere. IMO, what you are trying to achieve is not possible as you want the group to retain Contribute permissions in some subsites and remove it from some subsites.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.