The Complete SharePoint 2013/2016 Site Collection Permission Report using PowerShell

Another PowerShell report generating requirement: SharePoint Site Collection Permission Report to audit permissions on every object under a site collection.

This PowerShell script generates a report in HTML format, which consists of

  • Permission setup on All subsites under a site collection
  • Site collection administrators list
  • Permissions applied on each SharePoint object – Such as web (subsite), List, Folder and List Item.
  • Permissions configured for Users, SharePoint Group and AD Groups
  • SharePoint Groups and members of each group who has access.

How to run this script?
How to run the script? Well, Just copy-paste the given script below to either PowerShell ISE or notepad, save it something like “PermissionRpt.ps1”, change the configuration variables such as “Site collection URL, Output Report, etc. accordingly. Save and Hit F5!

sharepoint permissions report

SharePoint 2013/2010 Permissions Report using PowerShell

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

$HTMLTemplate=@"
<html>
<head>
<!-- Sal - Javascript Function to apply formatting -->
<script type="text/javascript">
function altRows(id){
 if(document.getElementsByTagName){     
  var table = document.getElementById(id);  
  var rows = table.getElementsByTagName("tr");     
  for(i = 0; i < rows.length; i++){          
   if(i % 2 == 0){
    rows[i].className = "evenrowcolor";
   }else{
    rows[i].className = "oddrowcolor";
   }      
  }
 }
}
window.onload=function(){
 altRows('alternatecolor');
}
</script>
 
<!-- CSS Styles for Table TH, TR and TD -->
<style type="text/css">
body{ font-family: Calibri; height: 12pt; }

table.altrowstable {
 border-collapse: collapse; font-family: verdana,arial,sans-serif;
 font-size:11px; color:#333333; border-width: 1px; border-color: #a9c6c9;
 border: b1a0c7 0.5pt solid; /*Sal Table format */  
}
table.altrowstable th {
 border-width: 1px; padding: 5px; background-color:#8064a2;
 border: #b1a0c7 0.5pt solid; font-family: Calibri; height: 15pt; 
 color: white;  font-size: 11pt;  font-weight: 700;  text-decoration: none;
}
table.altrowstable td {
 border: #b1a0c7 0.5pt solid; font-family: Calibri; height: 15pt; color: black; 
 font-size: 11pt; font-weight: 400; text-decoration: none; 
}
.oddrowcolor{ background-color: #e4dfec; }
.evenrowcolor{ background-color:#FFFFFF; }
</style>
</head>
<body>
"@

#Function to get permissions of an object Sal. Such as: Web, List, Folder, ListItem
Function Get-Permissions([Microsoft.SharePoint.SPRoleAssignmentCollection]$RoleAssignmentsCollection, $OutputReport)
{
   foreach($RoleAssignment in $RoleAssignmentsCollection) 
    { 
        #Get the Permissions assigned to Group/User
        $UserPermissions=@()
        foreach ($RoleDefinition in $RoleAssignment.RoleDefinitionBindings)
        {
            #Exclude "Limited Access" - We don't need it sal.
            if($RoleDefinition.Name -ne "Limited Access")
            {
                $UserPermissions += $RoleDefinition.Name +";"
            }    
        }
        
        if($UserPermissions)
        {
            #*** Get  User/Group Name *****#
            $UserGroupName=$RoleAssignment.Member.Name
            $UserName=$RoleAssignment.Member.LoginName  
            #**** Get User/Group Type ***** Is it a User or Group (SharePoint/AD)?
            #Is it a AD Domain Group?
            If($RoleAssignment.Member.IsDomainGroup)
                {
                   $Type="Domain Group"
                }
            #Is it a SharePoint Group?            
            Elseif($RoleAssignment.Member.GetType() -eq [Microsoft.SharePoint.SPGroup])
            {
                 $Type="SharePoint Group"
            }
            #it a SharePoint User Account
            else
            {
                   $Type="User"
            }
            #Send the Data to Report 
            " <tr> <td> $($UserGroupName) </td><td> $($Type) </td><td> $($UserName) </td><td>  $($UserPermissions)</td></tr>" >> $OutputReport
        }
    }
}

Function Generate-PermissionRpt()
{
    Param([Parameter(Mandatory=$true)] [string]$SiteCollectionURL,
          [Parameter(Mandatory=$true)] [string]$OutputReport, 
          [Parameter(Mandatory=$true)] [bool]$ScanFolders, 
          [Parameter(Mandatory=$true)] [bool]$ScanItemLevel) 

    #Try to Get the site collection  
    try
    { 
        $Site = Get-SPSite $SiteCollectionURL -ErrorAction SilentlyContinue
    }
    catch
    { 
        write-host Site Collection with URL:$SiteCollectionURL Does not Exists!
        return
    }   
    
    #Append the HTML File with CSS into the Output report
    $Content = $HTMLTemplate > $OutputReport
   
    "<h2> Site Collection Permission Report: $($Site.RootWeb.Title) </h2>" >> $OutputReport 
   
    #Table of Contents
    "<h3> List of Sites</h3> <table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr><th>Site Name </th><th> URL </th><th> Permission Setup </th></tr>" >> $OutputReport
    #Get Users of All Webs : Loop throuh all Sub Sites
    foreach($Web in $Site.AllWebs) 
    {
        
        if($Web.HasUniqueRoleAssignments -eq $true)
        {
            $PermissionSetup ="Unique Permissions"
        }
        else
        {
            $PermissionSetup="Inheriting from Parent"
        }
        
        "<tr> <td> <a href='#$($web.Title.ToLower())'>$($web.Title)</a> </td><td> $($web.URL)</td> <td> $($PermissionSetup)</td></tr>" >> $OutputReport
    }
   
    #Site Collection Administrators Heading 
    "</table><br/><b>Site Collection Administrators</b>" >> $OutputReport
     "<table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
 
    #Write Table Header
    "<th>User Account ID </th> <th>User Name </th></tr>" >> $OutputReport 
   
    #Get All Site Collection Administrators
    $Site.RootWeb.SiteAdministrators | sort $_.Name | ForEach-Object {  
    "<tr><td> $($_.LoginName) </td> <td> $($_.Name)</td></tr> " >> $OutputReport
    }

    $Counter=0;
    #Get Users of All Webs : Loop throuh all Sub Sites
    foreach($Web in $Site.AllWebs)
    { 
        Write-Progress -Activity "Collecting permissions data. Please wait..." -status "Processing Web: $($Web.URL)" -percentComplete ($Counter/$Site.AllWebs.count*100)
    
        #Check if site is using Unique Permissions or Inheriting from its Parent Site!
        if($Web.HasUniqueRoleAssignments -eq $true)
        {
            "</table><br/><hr> <h3>Site: <a name='$($Web.Title.ToLower())' href='$($web.URL)' target='_blank'>$($Web.Title)</a> is using Unique Permissions. </h3>" >> $OutputReport
        }
        else
        {
            "</table><br/><hr> <h3>Site: <a name='$($Web.Title.ToLower())' href='$($web.URL)' target='_blank'>$($Web.Title)</a> is Inheriting Permissions from its Parent Site.</h3>" >> $OutputReport
        }
   
        #Get the Users & Groups from site which has unique permissions - TOP sites always with Unique Permissions
        if($Web.HasUniqueRoleAssignments -eq $True)
        {        
            Write-host Processing Web $Web.URL
            #*** Get all the users granted permissions DIRECTLY to the site ***
            "<b>Site Permissions</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
            "<th>Users/Groups </th> <th> Type </th><th> User Name </th> <th>Permissions</th></tr>" >> $OutputReport

            #Call the function to get Permissions Applied 
            Get-Permissions $Web.RoleAssignments $OutputReport
        
              
            #****** Get Members of Each Group at Web Level *********#
            "</table></br> " >>$OutputReport
            
            #Check if any SharePoint Groups Exists, if yes, Get members of it
            $WebGroupRoleAssignments = $Web.RoleAssignments | Where { $_.Member.GetType() -eq [Microsoft.SharePoint.SPGroup]}
            if($WebGroupRoleAssignments)
            {
                "<b>Group Users</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >>$OutputReport
                foreach($WebRoleAssignment in $WebGroupRoleAssignments) 
                { 
                    "<th colspan='3'><b>Group:</b> $($WebRoleAssignment.Member.Name)</th></tr> " >> $OutputReport 
                    foreach($user in $WebRoleAssignment.member.users)
                    {
                        #Send the Data to Log file
                        " <tr> <td> $($user.Name) </td><td> $($user.LoginName) </td><td> $($user.Email)</td><tr>" >> $OutputReport
                    }
                }
            }
        } #Web.HasUniqueRoleAssignments Over      
      
     #********  Check All List's Permissions ********/
        foreach($List in $Web.lists)
        {
            #Skip the Hidden Lists
            if( ($List.HasUniqueRoleAssignments -eq $True) -and  ($List.Hidden -eq $false))
            {
                "</table><br/><b>List: [ $($List.Title) ] at <a href='$($List.ParentWeb.Url)/$($List.RootFolder.Url)'>$($List.ParentWeb.Url)/$($List.RootFolder.Url)</a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
                "<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport 
                   
                #Call the function to get Permissions Applied 
                Get-Permissions $List.RoleAssignments $OutputReport
            }
            "</table>" >>$OutputReport
            
            #********  Check Folders with Unique Permissions ********/
            if($ScanFolders -eq $True) 
            {
                $UniqueFolders = $List.Folders | where { $_.HasUniqueRoleAssignments -eq $True }     
                #Check if any folder has Unique Permission
                if($UniqueFolders) 
                {
                    #Get Folder permissions
                    foreach($folder in $UniqueFolders)
                    {
                        #Write Table Headers
                        $FolderURL=$folder.ParentList.ParentWeb.URL+"/"+$folder.Url
                        "<br/><b>Folder: <a href='$($FolderURL)' target='_blank'>$($Folder.Title)</a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
                        "<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport 

                        #Call the function to get Permissions Applied 
                        Get-Permissions $folder.RoleAssignments $OutputReport 
                        
                        "</table>" >>$OutputReport
                    }
                }
            }
            
            #********  Check Items with Unique Permissions ********/
            if($ScanItemLevel -eq $True) 
            {
                $UniqueItems = $List.Items  | where { $_.HasUniqueRoleAssignments -eq $True }     
                #Check if any Item has Unique Permission Sal
                if($UniqueItems) 
                {
                    #Get Folder permissions
                    foreach($Item in $UniqueItems)
                    {
                        #Get Item's Name if Title is NULL
                        if($Item.Title -ne $null) {$ItemTitle = $Item.Title } else {$ItemTitle= $Item["Name"] }
                        #Write Table Headers
                        $ItemURL= $item.ParentList.ParentWeb.Site.MakeFullUrl($item.ParentList.DefaultDisplayFormUrl)
                        "<br/><b>Item: <a target='_blank' href='$($ItemURL)?ID=$($Item.ID)'>$($ItemTitle)</a> in list/library <a href='$($List.ParentWeb.Url)/$($List.RootFolder.Url)'>$($List.Title) </a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
                        "<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport 

                        #Call the function to get Permissions Applied 
                        Get-Permissions $Item.RoleAssignments $OutputReport 
                        
                        "</table>" >>$OutputReport
                    }
                }
            }
        } #List
    $Counter=$Counter+1;        
    } #Web
"</body></html>" >>$OutputReport
Write-host "`n Permission report generated successfully at "$OutputReport 

}

#**********Configuration Variables************
$OutputReport = "C:\PermissionRpt.htm"
$SiteCollURL="https://portal.crescent.com"
$ScanFolders=$False
$ScanItemLevel=$False

#Call the function to Get Permissions Report
Generate-PermissionRpt $SiteCollURL $OutputReport $ScanFolders $ScanItemLevel

Output:
The script is included with a progress bar indicator. Once execution is completed, it generates an HTM file at the given location.

You can optionally turn on Folders & Item Level flags to include them in permission reporting. If so, You can expect some delays in script execution!

Here is a sample site collection permission report this script generated! 

sharepoint site collection permission report
This script doesn’t count “Limited Permissions”!

Salaudeen Rajack

Salaudeen Rajack - Information Technology Expert with Two-decades of hands-on experience, specializing in SharePoint, PowerShell, Microsoft 365, and related products. He has held various positions including SharePoint Architect, Administrator, Developer and consultant, has helped many organizations to implement and optimize SharePoint solutions. Known for his deep technical expertise, He's passionate about sharing the knowledge and insights to help others, through the real-world articles!

25 thoughts on “The Complete SharePoint 2013/2016 Site Collection Permission Report using PowerShell

  • Amazing work Love it.. added a few lines to add site name and date to the report..
    $URLroot = “https://…your usual root…./sites/”
    $datetime = Get-Date -Format g
    #Call the function to Get Permissions Report
    $EndOfURL = Read-Host -Prompt ‘New Action, Input end of URL.. https://…your usual root…./sites/’
    $url = $URLroot + $EndOfURL
    $rptfile = “\\network…location\2013PermissionsAudit\”
    $rptFileName = “SitePermissionRpt_$EndOfURL” + “_” + $datetime.Split(‘ ‘)[0].Replace(‘/’, ‘_’) + “.htm”
    $OutputReport = $rptfile + $rptFileName

    Generate-PermissionRpt $url $OutputReport $ScanFolders $ScanItemLevel

    thanks Maz0r for fix on line 220 😀

    Reply
  • Thanks so much. A requirement just came and this is just what I needed.

    Swanl

    Reply
  • I am looking for a sub-site and below that sub-site. How do I restrict and not see my entire site-collection

    Reply
  • Awesome script!!! Thank you sir!

    Reply
  • Hii,,could you please write the entire code in c# and post here

    Reply
  • this script is just awesome Salaudeen sir, u r a rockstar!

    Reply
  • I was glad to find this page as I am looking for a method to output SP permissions to a report. But after I edit the script appropriately and then run it, I get the following: Site Collection with URL: Does not Exists! I double checked the URL to ensure it is correct.

    My Site Collection is a SharePoint Online/Office 365 site. That is, I’m not running SharePoint on prem. Does that make a difference?

    Reply
  • I was glad to find this page as I am looking for a method to output SP permissions to a report. But after I edit the script appropriately and then run it, I get the following: Site Collection with URL: Does not Exists! I double checked the URL.

    Could my issue be that I’m running this against a SharePoint Online site?

    Reply
  • I’m getting this error any help?

    Generate-PermissionRpt : Cannot process argument transformation on parameter ‘ScanFolders’. Cannot convert value “” to type “System.Boolean”. Boolean parameters accept only Boolean values and numbers, such as $True, $False, 1
    or 0.
    At C:UsersbroeDownloadsPermissionRpt.ps1:270 char:51
    + … enerate-PermissionRpt $SiteCollURL $OutputReport $ScanFolders $ScanIt …
    + ~~~~~~~~~~~~
    + CategoryInfo : InvalidData: (:) [Generate-PermissionRpt], ParameterBindingArgumentTransformationException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,Generate-PermissionRpt

    Reply
  • Thanks Salaudeen Rajack. Great Work.

    Reply
  • It will be great if we get this report in excel.

    Reply
  • Is there a noob walk through for what fields I need to change to make this run? I am not a powershell person but I am doing my best to get through this. My new team has a complete garbage sharepoint site and I think this report will help get my supv on my side about the changes that need to be made.

    Reply
    • Hi Chris,
      Just save this script with .ps1 extention. Change the $OutputReport and $SiteCollURL values accordingly, Right click the ps1 file you saved, choose “Run with PowerShell”, Your report should be ready in few minutes.

      Reply
  • Great Script! Thanks for sharing. Just one question though as we are getting at the folder or item level the URL of the folder or item is not being captured and powershell is throwing below error

    Method invocation failed because [System.String] doesn’t contain a method named ‘op_Division’.
    At E:ScriptsPermissionReport.ps1:220 char:69
    + $FolderURL=$folder.ParentList.ParentWeb.URL/ <<<< $folder.Url + CategoryInfo : InvalidOperation: (op_Division:String) [], RuntimeException + FullyQualifiedErrorId : MethodNotFound can you please help in getting the accurate details for folders and items as well

    Reply
    • I fixed this by changing line 220
      from

      $FolderURL=$folder.ParentList.ParentWeb.URL/$folder.Url
      to
      $FolderURL=$folder.ParentList.ParentWeb.URL +”/”+ $folder.Url

      Reply
  • Great Script Salaudeen. Is it possible to change HTML format to CSV format though? Any advice would be greatly appreciated.

    Reply
  • Hi, thanks for sharing this. Is there a way to run this script for multiple site collection, can we import site collections from csv and generate a report ?

    Reply
    • Sure Vyas! Just call the function: Generate-PermissionRpt with all four parameters from the CSV file.

      Reply
    • What would I need to change on the script to generate a report for the webapplication for SharePoint 2019

      Reply
  • Hi salaudeen,

    Thanks for your great post, its very helpfull. Besides im very weak on scripting like this. Anyway, im trying to modify it so i can get the report with only spesific user but no result.
    Do you have any idea how to generate report only for spesific user we want?

    Thank you!!

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *