Monday, February 8, 2016

The Complete SharePoint 2013/2010 Site Collection Permission Report using PowerShell

Another PowerShell report generating requirement: SharePoint Site Collection Permission Report to audit permissions on each and every object under a site collection.

This PowerShell script generates a report in HTML format, which consists of

  • Permission setup on All subsites under a site collection
  • Site collection administrators list
  • Permissions applied on each SharePoint object - Such as web (subsite), List, Folder and List Item.
  • Permissions configured for Users, SharePoint Group and AD Groups
  • SharePoint Groups and members of each group who has access.
How to run this script?
How to run the script? Well, Just copy-paste the given script below to either PowerShell ISE or notepad, save it something like "PermissionRpt.ps1", change the configuration variables such as "Site collection URL, Output Report, etc. accordingly. Save and Hit F5!
sharepoint permissions report

SharePoint 2013/2010 permissions report PowerShell
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

$HTMLTemplate=@"
<html>
<head>
<!-- Sal - Javascript Function to apply formatting -->
<script type="text/javascript">
function altRows(id){
 if(document.getElementsByTagName){     
  var table = document.getElementById(id);  
  var rows = table.getElementsByTagName("tr");     
  for(i = 0; i < rows.length; i++){          
   if(i % 2 == 0){
    rows[i].className = "evenrowcolor";
   }else{
    rows[i].className = "oddrowcolor";
   }      
  }
 }
}
window.onload=function(){
 altRows('alternatecolor');
}
</script>
 
<!-- CSS Styles for Table TH, TR and TD -->
<style type="text/css">
body{ font-family: Calibri; height: 12pt; }

table.altrowstable {
 border-collapse: collapse; font-family: verdana,arial,sans-serif;
 font-size:11px; color:#333333; border-width: 1px; border-color: #a9c6c9;
 border: b1a0c7 0.5pt solid; /*Sal Table format */  
}
table.altrowstable th {
 border-width: 1px; padding: 5px; background-color:#8064a2;
 border: #b1a0c7 0.5pt solid; font-family: Calibri; height: 15pt; 
 color: white;  font-size: 11pt;  font-weight: 700;  text-decoration: none;
}
table.altrowstable td {
 border: #b1a0c7 0.5pt solid; font-family: Calibri; height: 15pt; color: black; 
 font-size: 11pt; font-weight: 400; text-decoration: none; 
}
.oddrowcolor{ background-color: #e4dfec; }
.evenrowcolor{ background-color:#FFFFFF; }
</style>
</head>
<body>
"@

#Function to get permissions of an object Sal. Such as: Web, List, Folder, ListItem
Function Get-Permissions([Microsoft.SharePoint.SPRoleAssignmentCollection]$RoleAssignmentsCollection, $OutputReport)
{
   foreach($RoleAssignment in $RoleAssignmentsCollection) 
    { 
        #Get the Permissions assigned to Group/User
        $UserPermissions=@()
        foreach ($RoleDefinition in $RoleAssignment.RoleDefinitionBindings)
        {
            #Exclude "Limited Access" - We don't need it sal.
            if($RoleDefinition.Name -ne "Limited Access")
            {
                $UserPermissions += $RoleDefinition.Name +";"
            }    
        }
        
        if($UserPermissions)
        {
            #*** Get  User/Group Name *****#
            $UserGroupName=$RoleAssignment.Member.Name
            $UserName=$RoleAssignment.Member.LoginName  
            #**** Get User/Group Type ***** Is it a User or Group (SharePoint/AD)?
            #Is it a AD Domain Group?
            If($RoleAssignment.Member.IsDomainGroup)
                {
                   $Type="Domain Group"
                }
            #Is it a SharePoint Group?            
            Elseif($RoleAssignment.Member.GetType() -eq [Microsoft.SharePoint.SPGroup])
            {
                 $Type="SharePoint Group"
            }
            #it a SharePoint User Account
            else
            {
                   $Type="User"
            }
            #Send the Data to Report 
            " <tr> <td> $($UserGroupName) </td><td> $($Type) </td><td> $($UserName) </td><td>  $($UserPermissions)</td></tr>" >> $OutputReport
        }
    }
}

Function Generate-PermissionRpt()
{
    Param([Parameter(Mandatory=$true)] [string]$SiteCollectionURL,
          [Parameter(Mandatory=$true)] [string]$OutputReport, 
          [Parameter(Mandatory=$true)] [bool]$ScanFolders, 
          [Parameter(Mandatory=$true)] [bool]$ScanItemLevel) 

    #Try to Get the site collection  
    try
    { 
        $Site = Get-SPSite $SiteCollectionURL -ErrorAction SilentlyContinue
    }
    catch
    { 
        write-host Site Collection with URL:$SiteCollectionURL Does not Exists!
        return
    }   
    
    #Append the HTML File with CSS into the Output report
    $Content = $HTMLTemplate > $OutputReport
   
    "<h2> Site Collection Permission Report: $($Site.RootWeb.Title) </h2>" >> $OutputReport 
   
    #Table of Contents
    "<h3> List of Sites</h3> <table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr><th>Site Name </th><th> URL </th><th> Permission Setup </th></tr>" >> $OutputReport
    #Get Users of All Webs : Loop throuh all Sub Sites
    foreach($Web in $Site.AllWebs) 
    {
        
        if($Web.HasUniqueRoleAssignments -eq $true)
        {
            $PermissionSetup ="Unique Permissions"
        }
        else
        {
            $PermissionSetup="Inheriting from Parent"
        }
        
        "<tr> <td> <a href='#$($web.Title.ToLower())'>$($web.Title)</a> </td><td> $($web.URL)</td> <td> $($PermissionSetup)</td></tr>" >> $OutputReport
    }
   
    #Site Collection Administrators Heading 
    "</table><br/><b>Site Collection Administrators</b>" >> $OutputReport
     "<table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
 
    #Write Table Header
    "<th>User Account ID </th> <th>User Name </th></tr>" >> $OutputReport 
   
    #Get All Site Collection Administrators
    $Site.RootWeb.SiteAdministrators | sort $_.Name | ForEach-Object {  
    "<tr><td> $($_.LoginName) </td> <td> $($_.Name)</td></tr> " >> $OutputReport
    }

    $Counter=0;
    #Get Users of All Webs : Loop throuh all Sub Sites
    foreach($Web in $Site.AllWebs)
    { 
        Write-Progress -Activity "Collecting permissions data. Please wait..." -status "Processing Web: $($Web.URL)" -percentComplete ($Counter/$Site.AllWebs.count*100)
    
        #Check if site is using Unique Permissions or Inheriting from its Parent Site!
        if($Web.HasUniqueRoleAssignments -eq $true)
        {
            "</table><br/><hr> <h3>Site: <a name='$($Web.Title.ToLower())' href='$($web.URL)' target='_blank'>$($Web.Title)</a> is using Unique Permissions. </h3>" >> $OutputReport
        }
        else
        {
            "</table><br/><hr> <h3>Site: <a name='$($Web.Title.ToLower())' href='$($web.URL)' target='_blank'>$($Web.Title)</a> is Inheriting Permissions from its Parent Site.</h3>" >> $OutputReport
        }
   
        #Get the Users & Groups from site which has unique permissions - TOP sites always with Unique Permissions
        if($Web.HasUniqueRoleAssignments -eq $True)
        {        
            Write-host Processing Web $Web.URL
            #*** Get all the users granted permissions DIRECTLY to the site ***
            "<b>Site Permissions</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
            "<th>Users/Groups </th> <th> Type </th><th> User Name </th> <th>Permissions</th></tr>" >> $OutputReport

            #Call the function to get Permissions Applied 
            Get-Permissions $Web.RoleAssignments $OutputReport
        
              
            #****** Get Members of Each Group at Web Level *********#
            "</table></br> " >>$OutputReport
            
            #Check if any SharePoint Groups Exists, if yes, Get members of it
            $WebGroupRoleAssignments = $Web.RoleAssignments | Where { $_.Member.GetType() -eq [Microsoft.SharePoint.SPGroup]}
            if($WebGroupRoleAssignments)
            {
                "<b>Group Users</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >>$OutputReport
                foreach($WebRoleAssignment in $WebGroupRoleAssignments) 
                { 
                    "<th colspan='3'><b>Group:</b> $($WebRoleAssignment.Member.Name)</th></tr> " >> $OutputReport 
                    foreach($user in $WebRoleAssignment.member.users)
                    {
                        #Send the Data to Log file
                        " <tr> <td> $($user.Name) </td><td> $($user.LoginName) </td><td> $($user.Email)</td><tr>" >> $OutputReport
                    }
                }
            }
        } #Web.HasUniqueRoleAssignments Over      
      
     #********  Check All List's Permissions ********/
        foreach($List in $Web.lists)
        {
            #Skip the Hidden Lists
            if( ($List.HasUniqueRoleAssignments -eq $True) -and  ($List.Hidden -eq $false))
            {
                "</table><br/><b>List: [ $($List.Title) ] at <a href='$($List.ParentWeb.Url)/$($List.RootFolder.Url)'>$($List.ParentWeb.Url)/$($List.RootFolder.Url)</a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
                "<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport 
                   
                #Call the function to get Permissions Applied 
                Get-Permissions $List.RoleAssignments $OutputReport
            }
            "</table>" >>$OutputReport
            
            #********  Check Folders with Unique Permissions ********/
            if($ScanFolders -eq $True) 
            {
                $UniqueFolders = $List.Folders | where { $_.HasUniqueRoleAssignments -eq $True }     
                #Check if any folder has Unique Permission
                if($UniqueFolders) 
                {
                    #Get Folder permissions
                    foreach($folder in $UniqueFolders)
                    {
                        #Write Table Headers
                        $FolderURL=$folder.ParentList.ParentWeb.URL/$folder.Url
                        "<br/><b>Folder: <a href='$($FolderURL)' target='_blank'>$($Folder.Title)</a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
                        "<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport 

                        #Call the function to get Permissions Applied 
                        Get-Permissions $folder.RoleAssignments $OutputReport 
                        
                        "</table>" >>$OutputReport
                    }
                }
            }
            
            #********  Check Items with Unique Permissions ********/
            if($ScanItemLevel -eq $True) 
            {
                $UniqueItems = $List.Items  | where { $_.HasUniqueRoleAssignments -eq $True }     
                #Check if any Item has Unique Permission Sal
                if($UniqueItems) 
                {
                    #Get Folder permissions
                    foreach($Item in $UniqueItems)
                    {
                        #Get Item's Name if Title is NULL
                        if($Item.Title -ne $null) {$ItemTitle = $Item.Title } else {$ItemTitle= $Item["Name"] }
                        #Write Table Headers
                        $ItemURL= $item.ParentList.ParentWeb.Site.MakeFullUrl($item.ParentList.DefaultDisplayFormUrl)
                        "<br/><b>Item: <a target='_blank' href='$($ItemURL)?ID=$($Item.ID)'>$($ItemTitle)</a> in list/library <a href='$($List.ParentWeb.Url)/$($List.RootFolder.Url)'>$($List.Title) </a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
                        "<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport 

                        #Call the function to get Permissions Applied 
                        Get-Permissions $Item.RoleAssignments $OutputReport 
                        
                        "</table>" >>$OutputReport
                    }
                }
            }
        } #List
    $Counter=$Counter+1;        
    } #Web
"</body></html>" >>$OutputReport
Write-host "`n Permission report generated successfully at "$OutputReport 

}

#**********Configuration Variables************
$OutputReport = "C:\PermissionRpt.htm"
$SiteCollURL="http://portal.crescent.com"
$ScanFolders=$False
$ScanItemLevel=$False

#Call the function to Get Permissions Report
Generate-PermissionRpt $SiteCollURL $OutputReport $ScanFolders $ScanItemLevel

Output:
Script is included with a progress bar indicator. Once execution completed, it generates a HTM file at given location.
You can optionally turn on Folders & Item Level flags to include them in permission reporting. If so, You can expect some delays in script execution!

Here is a sample site collection permission report this script generated! 
sharepoint site collection permission report
This script doesn't count "Limited Permissions"!



You might also like:
SharePoint Usage Reports
Usage reports, collaboration and audit for SharePoint.
Document SharePoint Farm
Automatically generate SharePoint documentation.
*Sponsored


Check out these SharePoint products:

9 comments :

  1. Hi salaudeen,

    Thanks for your great post, its very helpfull. Besides im very weak on scripting like this. Anyway, im trying to modify it so i can get the report with only spesific user but no result.
    Do you have any idea how to generate report only for spesific user we want?

    Thank you!!

    ReplyDelete
  2. Hi, thanks for sharing this. Is there a way to run this script for multiple site collection, can we import site collections from csv and generate a report ?

    ReplyDelete
    Replies
    1. Sure Vyas! Just call the function: Generate-PermissionRpt with all four parameters from the CSV file.

      Delete
  3. Great Script Salaudeen. Is it possible to change HTML format to CSV format though? Any advice would be greatly appreciated.

    ReplyDelete
  4. Great Script! Thanks for sharing. Just one question though as we are getting at the folder or item level the URL of the folder or item is not being captured and powershell is throwing below error

    Method invocation failed because [System.String] doesn't contain a method named 'op_Division'.
    At E:\Scripts\PermissionReport.ps1:220 char:69
    + $FolderURL=$folder.ParentList.ParentWeb.URL/ <<<< $folder.Url
    + CategoryInfo : InvalidOperation: (op_Division:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

    can you please help in getting the accurate details for folders and items as well

    ReplyDelete
  5. Is there a noob walk through for what fields I need to change to make this run? I am not a powershell person but I am doing my best to get through this. My new team has a complete garbage sharepoint site and I think this report will help get my supv on my side about the changes that need to be made.

    ReplyDelete
    Replies
    1. Hi Chris,
      Just save this script with .ps1 extention. Change the $OutputReport and $SiteCollURL values accordingly, Right click the ps1 file you saved, choose "Run with PowerShell", Your report should be ready in few minutes.

      Delete
  6. It will be great if we get this report in excel.

    ReplyDelete

Please Login and comment to get your questions answered!

You might also like:

Related Posts Plugin for WordPress, Blogger...