Use case: Needed to understand the current security layout of a SharePoint site that was migrated from 2007 to 2010. The customer didn’t know what permissions were set where. They needed a way to report on how each site was granting or restricting permissions.
*Notes:
- I’m not disposing of any objects. Sure I understand this is bad, but the intention of this script is to be run one time in a test environment. So if you plan on running this in production, I would suggest adding the dispose objects.
- Script is set to put the raw xml file at the C:\, you change this in the .ps1 file.
- Runs against all web applications in farm minus central admin.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 | $logfilepath = "C:\" ##Create Table - ScanTable $ScanTable = New-Object system.Data.DataTable "ScanTable" $col1 = New-Object system.Data.DataColumn ("URL", [string]) $col2 = New-Object system.Data.DataColumn ("Member", [string]) $col3 = New-Object system.Data.DataColumn ("BasePermissions", [string]) $col4 = New-Object system.Data.DataColumn ("PermFriendlyName", [string]) $col5 = New-Object system.Data.DataColumn ("User_Group", [string]) $ScanTable.columns.add($col1) $ScanTable.columns.add($col2) $ScanTable.columns.add($col3) $ScanTable.columns.add($col4) $ScanTable.columns.add($col5) $PermLevels = @{} function getsec { Add-PSSnapin microsoft.sharepoint.powershell -ErrorAction SilentlyContinue $PortalName = Get-SPWebApplication | select DisplayName foreach ($p in $PortalName) { $webapp = Get-SPWebApplication | ? {$_.DisplayName -eq $p.Displayname} #$webapp = Get-SPWebApplication | ? {$_.DisplayName -eq "SharePoint"} foreach ($s in $webapp.Sites) { foreach ($web in $s.AllWebs) { foreach ($r in $web.roles) { $permpermmask = $r.PermissionMask $permname = $r.Name $PermLevels.Add("$permpermmask", "$permname") trap [Exception] {continue;} } $red = $web.HasUniqueRoleDefinitions foreach ($perm in $web.Permissions) { #$perm | select * #$perm.PermissionMask $permpermmaskcurrent = $perm.PermissionMask $level = $PermLevels.Get_Item("$permpermmaskcurrent") if ($perm.xml -like "*GroupName*") { $usergroup = "SharePoint Group" } if ($perm.xml -like "*UserLogin*") { $usergroup = "AD User" } $MemberIsADGroup = $perm.Member.IsDomainGroup if ($MemberIsADGroup -eq $true) { $usergroup = "AD Group" } $output = $ScanTable.Rows.Add($web.url, $perm.Member, $perm.BasePermissions, $level, $usergroup) } } } } $ScanTable.WriteXML("$logfilepath\SecurityReport.xml") } getsec |
