The Complete SharePoint 2013/2016 Site Collection Permission Report using PowerShell
Another PowerShell report generating requirement: SharePoint Site Collection Permission Report to audit permissions on every object under a site collection.
This PowerShell script generates a report in HTML format, which consists of
- Permission setup on All subsites under a site collection
- Site collection administrators list
- Permissions applied on each SharePoint object – Such as web (subsite), List, Folder and List Item.
- Permissions configured for Users, SharePoint Group and AD Groups
- SharePoint Groups and members of each group who has access.
How to run this script?
How to run the script? Well, Just copy-paste the given script below to either PowerShell ISE or notepad, save it something like “PermissionRpt.ps1”, change the configuration variables such as “Site collection URL, Output Report, etc. accordingly. Save and Hit F5!
SharePoint 2013/2010 Permissions Report using PowerShell
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
[email protected]"
<html>
<head>
<!-- Sal - Javascript Function to apply formatting -->
<script type="text/javascript">
function altRows(id){
if(document.getElementsByTagName){
var table = document.getElementById(id);
var rows = table.getElementsByTagName("tr");
for(i = 0; i < rows.length; i++){
if(i % 2 == 0){
rows[i].className = "evenrowcolor";
}else{
rows[i].className = "oddrowcolor";
}
}
}
}
window.onload=function(){
altRows('alternatecolor');
}
</script>
<!-- CSS Styles for Table TH, TR and TD -->
<style type="text/css">
body{ font-family: Calibri; height: 12pt; }
table.altrowstable {
border-collapse: collapse; font-family: verdana,arial,sans-serif;
font-size:11px; color:#333333; border-width: 1px; border-color: #a9c6c9;
border: b1a0c7 0.5pt solid; /*Sal Table format */
}
table.altrowstable th {
border-width: 1px; padding: 5px; background-color:#8064a2;
border: #b1a0c7 0.5pt solid; font-family: Calibri; height: 15pt;
color: white; font-size: 11pt; font-weight: 700; text-decoration: none;
}
table.altrowstable td {
border: #b1a0c7 0.5pt solid; font-family: Calibri; height: 15pt; color: black;
font-size: 11pt; font-weight: 400; text-decoration: none;
}
.oddrowcolor{ background-color: #e4dfec; }
.evenrowcolor{ background-color:#FFFFFF; }
</style>
</head>
<body>
"@
#Function to get permissions of an object Sal. Such as: Web, List, Folder, ListItem
Function Get-Permissions([Microsoft.SharePoint.SPRoleAssignmentCollection]$RoleAssignmentsCollection, $OutputReport)
{
foreach($RoleAssignment in $RoleAssignmentsCollection)
{
#Get the Permissions assigned to Group/User
[email protected]()
foreach ($RoleDefinition in $RoleAssignment.RoleDefinitionBindings)
{
#Exclude "Limited Access" - We don't need it sal.
if($RoleDefinition.Name -ne "Limited Access")
{
$UserPermissions += $RoleDefinition.Name +";"
}
}
if($UserPermissions)
{
#*** Get User/Group Name *****#
$UserGroupName=$RoleAssignment.Member.Name
$UserName=$RoleAssignment.Member.LoginName
#**** Get User/Group Type ***** Is it a User or Group (SharePoint/AD)?
#Is it a AD Domain Group?
If($RoleAssignment.Member.IsDomainGroup)
{
$Type="Domain Group"
}
#Is it a SharePoint Group?
Elseif($RoleAssignment.Member.GetType() -eq [Microsoft.SharePoint.SPGroup])
{
$Type="SharePoint Group"
}
#it a SharePoint User Account
else
{
$Type="User"
}
#Send the Data to Report
" <tr> <td> $($UserGroupName) </td><td> $($Type) </td><td> $($UserName) </td><td> $($UserPermissions)</td></tr>" >> $OutputReport
}
}
}
Function Generate-PermissionRpt()
{
Param([Parameter(Mandatory=$true)] [string]$SiteCollectionURL,
[Parameter(Mandatory=$true)] [string]$OutputReport,
[Parameter(Mandatory=$true)] [bool]$ScanFolders,
[Parameter(Mandatory=$true)] [bool]$ScanItemLevel)
#Try to Get the site collection
try
{
$Site = Get-SPSite $SiteCollectionURL -ErrorAction SilentlyContinue
}
catch
{
write-host Site Collection with URL:$SiteCollectionURL Does not Exists!
return
}
#Append the HTML File with CSS into the Output report
$Content = $HTMLTemplate > $OutputReport
"<h2> Site Collection Permission Report: $($Site.RootWeb.Title) </h2>" >> $OutputReport
#Table of Contents
"<h3> List of Sites</h3> <table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr><th>Site Name </th><th> URL </th><th> Permission Setup </th></tr>" >> $OutputReport
#Get Users of All Webs : Loop throuh all Sub Sites
foreach($Web in $Site.AllWebs)
{
if($Web.HasUniqueRoleAssignments -eq $true)
{
$PermissionSetup ="Unique Permissions"
}
else
{
$PermissionSetup="Inheriting from Parent"
}
"<tr> <td> <a href='#$($web.Title.ToLower())'>$($web.Title)</a> </td><td> $($web.URL)</td> <td> $($PermissionSetup)</td></tr>" >> $OutputReport
}
#Site Collection Administrators Heading
"</table><br/><b>Site Collection Administrators</b>" >> $OutputReport
"<table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
#Write Table Header
"<th>User Account ID </th> <th>User Name </th></tr>" >> $OutputReport
#Get All Site Collection Administrators
$Site.RootWeb.SiteAdministrators | sort $_.Name | ForEach-Object {
"<tr><td> $($_.LoginName) </td> <td> $($_.Name)</td></tr> " >> $OutputReport
}
$Counter=0;
#Get Users of All Webs : Loop throuh all Sub Sites
foreach($Web in $Site.AllWebs)
{
Write-Progress -Activity "Collecting permissions data. Please wait..." -status "Processing Web: $($Web.URL)" -percentComplete ($Counter/$Site.AllWebs.count*100)
#Check if site is using Unique Permissions or Inheriting from its Parent Site!
if($Web.HasUniqueRoleAssignments -eq $true)
{
"</table><br/><hr> <h3>Site: <a name='$($Web.Title.ToLower())' href='$($web.URL)' target='_blank'>$($Web.Title)</a> is using Unique Permissions. </h3>" >> $OutputReport
}
else
{
"</table><br/><hr> <h3>Site: <a name='$($Web.Title.ToLower())' href='$($web.URL)' target='_blank'>$($Web.Title)</a> is Inheriting Permissions from its Parent Site.</h3>" >> $OutputReport
}
#Get the Users & Groups from site which has unique permissions - TOP sites always with Unique Permissions
if($Web.HasUniqueRoleAssignments -eq $True)
{
Write-host Processing Web $Web.URL
#*** Get all the users granted permissions DIRECTLY to the site ***
"<b>Site Permissions</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
"<th>Users/Groups </th> <th> Type </th><th> User Name </th> <th>Permissions</th></tr>" >> $OutputReport
#Call the function to get Permissions Applied
Get-Permissions $Web.RoleAssignments $OutputReport
#****** Get Members of Each Group at Web Level *********#
"</table></br> " >>$OutputReport
#Check if any SharePoint Groups Exists, if yes, Get members of it
$WebGroupRoleAssignments = $Web.RoleAssignments | Where { $_.Member.GetType() -eq [Microsoft.SharePoint.SPGroup]}
if($WebGroupRoleAssignments)
{
"<b>Group Users</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >>$OutputReport
foreach($WebRoleAssignment in $WebGroupRoleAssignments)
{
"<th colspan='3'><b>Group:</b> $($WebRoleAssignment.Member.Name)</th></tr> " >> $OutputReport
foreach($user in $WebRoleAssignment.member.users)
{
#Send the Data to Log file
" <tr> <td> $($user.Name) </td><td> $($user.LoginName) </td><td> $($user.Email)</td><tr>" >> $OutputReport
}
}
}
} #Web.HasUniqueRoleAssignments Over
#******** Check All List's Permissions ********/
foreach($List in $Web.lists)
{
#Skip the Hidden Lists
if( ($List.HasUniqueRoleAssignments -eq $True) -and ($List.Hidden -eq $false))
{
"</table><br/><b>List: [ $($List.Title) ] at <a href='$($List.ParentWeb.Url)/$($List.RootFolder.Url)'>$($List.ParentWeb.Url)/$($List.RootFolder.Url)</a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
"<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport
#Call the function to get Permissions Applied
Get-Permissions $List.RoleAssignments $OutputReport
}
"</table>" >>$OutputReport
#******** Check Folders with Unique Permissions ********/
if($ScanFolders -eq $True)
{
$UniqueFolders = $List.Folders | where { $_.HasUniqueRoleAssignments -eq $True }
#Check if any folder has Unique Permission
if($UniqueFolders)
{
#Get Folder permissions
foreach($folder in $UniqueFolders)
{
#Write Table Headers
$FolderURL=$folder.ParentList.ParentWeb.URL+"/"+$folder.Url
"<br/><b>Folder: <a href='$($FolderURL)' target='_blank'>$($Folder.Title)</a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
"<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport
#Call the function to get Permissions Applied
Get-Permissions $folder.RoleAssignments $OutputReport
"</table>" >>$OutputReport
}
}
}
#******** Check Items with Unique Permissions ********/
if($ScanItemLevel -eq $True)
{
$UniqueItems = $List.Items | where { $_.HasUniqueRoleAssignments -eq $True }
#Check if any Item has Unique Permission Sal
if($UniqueItems)
{
#Get Folder permissions
foreach($Item in $UniqueItems)
{
#Get Item's Name if Title is NULL
if($Item.Title -ne $null) {$ItemTitle = $Item.Title } else {$ItemTitle= $Item["Name"] }
#Write Table Headers
$ItemURL= $item.ParentList.ParentWeb.Site.MakeFullUrl($item.ParentList.DefaultDisplayFormUrl)
"<br/><b>Item: <a target='_blank' href='$($ItemURL)?ID=$($Item.ID)'>$($ItemTitle)</a> in list/library <a href='$($List.ParentWeb.Url)/$($List.RootFolder.Url)'>$($List.Title) </a> is using Unique Permissions.</b><table class='altrowstable' id='alternatecolor' cellpadding='5px'><tr>" >> $OutputReport
"<th>Users/Groups </th><th> Type </th><th> User Name </th><th> Permissions</th></tr>" >> $OutputReport
#Call the function to get Permissions Applied
Get-Permissions $Item.RoleAssignments $OutputReport
"</table>" >>$OutputReport
}
}
}
} #List
$Counter=$Counter+1;
} #Web
"</body></html>" >>$OutputReport
Write-host "`n Permission report generated successfully at "$OutputReport
}
#**********Configuration Variables************
$OutputReport = "C:\PermissionRpt.htm"
$SiteCollURL="https://portal.crescent.com"
$ScanFolders=$False
$ScanItemLevel=$False
#Call the function to Get Permissions Report
Generate-PermissionRpt $SiteCollURL $OutputReport $ScanFolders $ScanItemLevel
Output:
The script is included with a progress bar indicator. Once execution is completed, it generates an HTM file at the given location.
You can optionally turn on Folders & Item Level flags to include them in permission reporting. If so, You can expect some delays in script execution!
Here is a sample site collection permission report this script generated!
This script doesn’t count “Limited Permissions”!
Amazing work Love it.. added a few lines to add site name and date to the report..
$URLroot = “https://…your usual root…./sites/”
$datetime = Get-Date -Format g
#Call the function to Get Permissions Report
$EndOfURL = Read-Host -Prompt ‘New Action, Input end of URL.. https://…your usual root…./sites/’
$url = $URLroot + $EndOfURL
$rptfile = “\\network…location\2013PermissionsAudit\”
$rptFileName = “SitePermissionRpt_$EndOfURL” + “_” + $datetime.Split(‘ ‘)[0].Replace(‘/’, ‘_’) + “.htm”
$OutputReport = $rptfile + $rptFileName
Generate-PermissionRpt $url $OutputReport $ScanFolders $ScanItemLevel
thanks Maz0r for fix on line 220 😀
Thanks so much. A requirement just came and this is just what I needed.
Swanl
I am looking for a sub-site and below that sub-site. How do I restrict and not see my entire site-collection
Awesome script!!! Thank you sir!
Hii,,could you please write the entire code in c# and post here
this script is just awesome Salaudeen sir, u r a rockstar!
I was glad to find this page as I am looking for a method to output SP permissions to a report. But after I edit the script appropriately and then run it, I get the following: Site Collection with URL: Does not Exists! I double checked the URL to ensure it is correct.
My Site Collection is a SharePoint Online/Office 365 site. That is, I’m not running SharePoint on prem. Does that make a difference?
Yes! This script is written for On-Prem!
Here is my another script for SharePoint Online SharePoint Online: Site Collection Permissions Report using PowerShell
I was glad to find this page as I am looking for a method to output SP permissions to a report. But after I edit the script appropriately and then run it, I get the following: Site Collection with URL: Does not Exists! I double checked the URL.
Could my issue be that I’m running this against a SharePoint Online site?
I’m getting this error any help?
Generate-PermissionRpt : Cannot process argument transformation on parameter ‘ScanFolders’. Cannot convert value “” to type “System.Boolean”. Boolean parameters accept only Boolean values and numbers, such as $True, $False, 1
or 0.
At C:UsersbroeDownloadsPermissionRpt.ps1:270 char:51
+ … enerate-PermissionRpt $SiteCollURL $OutputReport $ScanFolders $ScanIt …
+ ~~~~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [Generate-PermissionRpt], ParameterBindingArgumentTransformationException
+ FullyQualifiedErrorId : ParameterArgumentTransformationError,Generate-PermissionRpt
Thanks Salaudeen Rajack. Great Work.
It will be great if we get this report in excel.
Is there a noob walk through for what fields I need to change to make this run? I am not a powershell person but I am doing my best to get through this. My new team has a complete garbage sharepoint site and I think this report will help get my supv on my side about the changes that need to be made.
Hi Chris,
Just save this script with .ps1 extention. Change the $OutputReport and $SiteCollURL values accordingly, Right click the ps1 file you saved, choose “Run with PowerShell”, Your report should be ready in few minutes.
Great Script! Thanks for sharing. Just one question though as we are getting at the folder or item level the URL of the folder or item is not being captured and powershell is throwing below error
Method invocation failed because [System.String] doesn’t contain a method named ‘op_Division’.
At E:ScriptsPermissionReport.ps1:220 char:69
+ $FolderURL=$folder.ParentList.ParentWeb.URL/ <<<< $folder.Url + CategoryInfo : InvalidOperation: (op_Division:String) [], RuntimeException + FullyQualifiedErrorId : MethodNotFound can you please help in getting the accurate details for folders and items as well
I fixed this by changing line 220
from
$FolderURL=$folder.ParentList.ParentWeb.URL/$folder.Url
to
$FolderURL=$folder.ParentList.ParentWeb.URL +”/”+ $folder.Url
Thanks for the catch. Fixed it!
Great Script Salaudeen. Is it possible to change HTML format to CSV format though? Any advice would be greatly appreciated.
Hi, thanks for sharing this. Is there a way to run this script for multiple site collection, can we import site collections from csv and generate a report ?
Sure Vyas! Just call the function: Generate-PermissionRpt with all four parameters from the CSV file.
What would I need to change on the script to generate a report for the webapplication for SharePoint 2019
This script works on SharePoint 2019 as well.
Hi salaudeen,
Thanks for your great post, its very helpfull. Besides im very weak on scripting like this. Anyway, im trying to modify it so i can get the report with only spesific user but no result.
Do you have any idea how to generate report only for spesific user we want?
Thank you!!
Here you go: SharePoint 2013 User Permission Analysis & Reporting using PowerShell