Controlling Office 365 Admin Access with Azure AD Privileged Identity Management (PIM)

   Controlling, monitoring, and revoking access to privileged accounts can be a difficult process.  Recently my coworker Ken Kilty shared with me a new service for Azure Active Directory called Privileged Identity Management (Azure AD PIM).  After spending some time with it I wanted to share with a broader audience since I had never heard of it previously.

image

 

Overview

   Please read the What is Azure AD Privileged Identity Management first for a good overview of implementation, example scenario, and additional links to resources.  Note that Azure AD PIM requires Azure AD Premium P2 licenses.  If you would like to test this out there is a free 30 day trial of Azure AD Premium P2 for up to 100 users.

   Granting administrator access, for any application or server, to users should always be done with caution.  Sometimes what starts out as a temporary elevation of permissions turns into a permanent assignment.  Azure AD PIM answers many of the tough questions for Azure AD, Office 365, and related services such as:

  • Who has admin access to <service X>?
  • How do I grant truly temporary access to <service Y>?
  • How can I review all current admins to see if they still need admin access?

   The goal with Azure AD PIM is to allow administrators to define either permanent or “eligible” assignment of specific elevated permissions within Azure and Office 365.  Currently there are 21 roles that can be managed such as Global Administrator, Password Administrator, SharePoint Service Administrator, Exchange Administrator, and more.  See Assigning administrator roles in Azure Active Directory for a more complete listing of roles.  Users who are defined as “eligible” will be able to elevate themselves to roles they have been assigned for a set number of hours (1-72) defined by a Azure AD PIM administrator.  During this role elevation process the “eligible” user will need to verify their identity through a text / call verification or multifactor authentication (MFA) mechanism.  One of the key advantages is that this entire interaction is tracked and auditable.  Administrators can even require an incident or service ticket number prior to elevation and receive alerts when elevation requests are processed.

 

Conclusion

   I have seen privileged role access handled in many different ways at customers over the years.  Having a consistent and auditable process ensures that changes can be tracked and users who no longer need elevated permissions can be removed.  In the time I’ve tested out Azure AD Privileged Identity Management I am very happy with the overall process and review options.  One word of advice for users elevating yourself.  You will need to log out and log back in in order to update your claim token with the new elevated role claims.  Give Azure Active Directory Privileged Identity Management a try and share any feedback in the comments below.

 

      -Frog Out

My Experience Configuring Cloud Hybrid Search Service Application for SharePoint

   In this post I’ll talk through my personal experience deploying the new cloud hybrid search service application for SharePoint 2013 (also available in SharePoint 2016).  By no means am I an expert on this topic (especially in many of the supporting technologies such as AAD Connect, AD FS, etc.) but this is more meant to increase exposure to this new offering.  For an overview of cloud hybrid search and more information about actual implementation (which I will refer back to later) please read through Cloud Hybrid Search Service Application written by two of my Microsoft peers Neil and Manas (they are the true experts).

 

Components

   Here is a list of the high level components I used for my deployment.

Note: My Azure VM configuration is not using best practices for where or how to deploy different services.  Also my mention of GoDaddy and DigiCert are purely for example purposes and not an endorsement for either company.  I just happen to use their services and products in this scenario.

  • Office 365 (O365) trial tenant (sign up for one here)
  • 4 Azure VMs
    • A1 – Active Directory Domain Services (AD DS)
    • A1 – Active Directory Federation Services (AD FS)
    • A2 – Azure Active Directory Connect (AAD Connect), Web Application Proxy (WAP)
    • A4 – SQL Server 2014, SharePoint 2013 farm with Service Pack 1 and at least Aug 2015 CU
  • Custom domain (purchased through GoDaddy but any domain registrar should work)
    • Note: Office 365 does have a partnership with GoDaddy so configuration may be easier due to automated updates that can be performed
    • Additionally I was able to modify public DNS records through GoDaddy to allow federated authentication through AD FS
  • SSL wildcard certificate purchased from DigiCert
    • Only required if want to allow Office 365 user to open / preview a search result that resides on-prem with Office Online Server (new version of Office Web Apps Server 2013, not discussed in this post)
    • I also used this certificate for other purposes such as securing AD FS communication and implementing Remote Desktop Gateway (the latter is unrelated to this post)
  • Custom result source to display O365 search results in my on-prem farm

 

   Next we’ll take a look at some of these components more in depth.

 

SharePoint Server

   The new cloud hybrid search service application is available in SharePoint Server 2013 with the August 2015 CU or later.  I have heard from my peers that there are some issues with cloud hybrid search as of the October, November, and December 2015 CUs.  As such use either the August or September 2015 CUs at the time of this writing (Dec 8, 2015) or wait until the Jan 2016 CU which should contain the fix (link).  The SharePoint Server 2016 IT Preview 1 also supports cloud hybrid search although I have not tested it out myself.

 

Cloud Search Service Application

   To provision a cloud hybrid search service application the property CloudIndex on the service application must be set to True.  This property is a read-only property and can only be set at creation time.  As such you will need to create a new search service application in order to utilize the cloud hybrid search service.

   I have not tested creating a new cloud hybrid search service application using a restored backup admin database from an existing search service application.  The thought behind this would be to retain at least a portion of your existing search service application.  If you try this and have any findings let me know in the comments below.

 

Custom Domain

   A custom domain is not a requirement for cloud hybrid search.  I used one so that I could allow end users (demo accounts) to log into Office 365 as a federated user “someUser@<fakecompany>.com” rather than the default domain “someUser@<O365TenantDomain>.onmicrosoft.com”.

 

AAD Connect

   In order to search for on-prem content that has been indexed by Office 365 the user will need to have an account that is synchronized to Azure Active Directory / Office 365.  This allows the search service in Office 365 to show content based on the Access Control List (ACL) defined on-prem.

   There are multiple options available for synchronizing accounts between on-prem and AAD but the predominate ones include DirSync, AAD Sync, and AAD Connect.  Since AAD Connect is the future looking tool of choice of these three I decided to use it.  AAD Connect automates many of the tedious tasks of configuring federated authentication by stepping through a wizard.

   That said I did run into a number of issues during configuration due to missing certificates, invalid permissions, or other steps I missed or was unaware of.  If I got part of the way through the configuration and ran into a failure that I couldn’t recover from then I had to uninstall AAD Connect (do not remove all prerequisites when prompted), wipe out the contents of “<install drive>:Program FilesMicrosoft Azure AD SyncData”, and then re-install.

 

Display Search Results On-Prem

 

***PLEASE READ AS THIS IS IMPORTANT***

    The default scenario for cloud hybrid search is to index both on-prem and O365 content which are then queried in O365.  It is possible to create or modify an on-prem result source to use the remote index from your Office 365 tenant which allows for querying and display the combined search results on-prem.  The problem though is that when you query for and click results on-prem the search analytics click data is not incorporated back to the cloud index to further influence search results.

Ex. I queried for “SharePoint” in on-prem search center and clicked the 4th result on result page.  Multiple other users also searched for “SharePoint” and clicked the same 4th result.  SharePoint search (via timer jobs and other background processes) incorporates that click data and adjusts the 4th result to now appear higher in rankings upon subsequent search queries.

   I have unsuccessfully tested a few options to manually pass the search click data up to SharePoint Online.  These include creating a ClientContext object and calling the RecordPageClick() method on SearchExecutor, modifying the display template page, and more.  I did hear from a SharePoint MVP that successfully tested out a way to push search analytics data between on-prem and O365 but it took a fair amount of customizations to accomplish.  If I find out any additional information, workaround, or updates on this topic I’ll update this post to reflect that.

 

Example

   As you can see from the below screenshots I can initiate a search query from on-prem or O365 (respectively) and get the same combined result set.

 

OnPremResults

 

SPOResults

 

 

Conclusion

   Due to my prior inexperience around AD FS, Web Application Proxy, AAD Connect, and other applications it took me a few days to get everything working end-to-end.  After that small hurdle I was very excited to be seeing combined on-prem and O365 search results in both on-prem and O365.  Do note though the section above calling out the current issue with search analytics data not being sent back and forth.  Aside from that I am looking forward to testing this out with customers and reaping the many benefits such as inclusion of content in the Microsoft Graph (formerly Office Graph) / Delve and other O365 only offerings.

 

      -Frog Out

PowerShell Script to Enumerate SharePoint 2010 or 2013 Permissions and Active Directory Group Membership

   In this post I will present a script to enumerate SharePoint 2010 or 2013 permissions across the entire farm down to the site (SPWeb) level.  As a bonus this script also recursively expands the membership of any Active Directory (AD) group including nested groups which you wouldn’t be able to find through the SharePoint UI.

 

History

    Back in 2009 (over 4 years ago now) I published one my most read blog posts about enumerating SharePoint 2007 permissions.  I finally got around to updating that script to remove deprecated APIs, supporting the SharePoint 2010 commandlets, and fixing a few bugs.  There are 2 things that script did that I had to remove due to major architectural or procedural changes in the script.

  1. Indenting the XML output
  2. Ability to search for a specific user

   I plan to add back the ability to search for a specific user but wanted to get this version published first.  As for indenting the XML that could be added but would take some effort.  If there is user demand for it (let me know in the comments or email me using the contact button at top of blog) I’ll move it up in priorities.

   As a side note you may also notice that I’m not using the Active Directory commandlets.  This was a conscious decision since not all environments have them available.  Instead I’m relying on the older [ADSI] type accelerator and APIs.  It does add a significant amount of code to the script but it is necessary for compatibility.  Hopefully in a few years if I need to update again I can remove that legacy code.

 

Solution

   Below is the script to enumerate SharePoint 2010 and 2013 permissions down to site level.  You can also download it from my SkyDrive account or my posting on the TechNet Script Center Repository.

SkyDrive

TechNet Script Center Repository

http://gallery.technet.microsoft.com/scriptcenter/Enumerate-SharePoint-2010-35976bdb

########################################################### 
#DisplaySPWebApp8.ps1 
# 
#Author: Brian T. Jackett 
#Last Modified Date: 2013-07-01 
# 
#Traverse the entire web app site by site to display 
# hierarchy and users with permissions to site. 
########################################################### 

function Expand-ADGroupMembership 
{ 
    Param 
    ( 
        [Parameter(Mandatory=$true, 
                   Position=0)] 
        [string] 
        $ADGroupName, 
        [Parameter(Position=1)] 
        [string] 
        $RoleBinding 
    ) 
    Process 
    { 
        $roleBindingText = “” 
        if(-not [string]::IsNullOrEmpty($RoleBinding)) 
        { 
            $roleBindingText = ” RoleBindings=`”$roleBindings`”” 
        } 
        Write-Output “<ADGroup Name=`”$($ADGroupName)`”$roleBindingText>” 
        $domain = $ADGroupName.substring(0, $ADGroupName.IndexOf(“”) + 1) 
        $groupName = $ADGroupName.Remove(0, $ADGroupName.IndexOf(“”) + 1) 
                            
        #BEGIN – CODE ADAPTED FROM SCRIPT CENTER SAMPLE CODE REPOSITORY 
        #http://www.microsoft.com/technet/scriptcenter/scripts/powershell/search/users/srch106.mspx 
        #GET AD GROUP FROM DIRECTORY SERVICES SEARCH 
        $strFilter = “(&(objectCategory=Group)(name=”+($groupName)+“))” 
        $objDomain = New-Object System.DirectoryServices.DirectoryEntry 
        $objSearcher = New-Object System.DirectoryServices.DirectorySearcher 
        $objSearcher.SearchRoot = $objDomain 
        $objSearcher.Filter = $strFilter 
        # specify properties to be returned 
        $colProplist = (“name”,“member”,“objectclass”) 
        foreach ($i in $colPropList) 
        { 
            $catcher = $objSearcher.PropertiesToLoad.Add($i) 
        } 
        $colResults = $objSearcher.FindAll() 
        #END – CODE ADAPTED FROM SCRIPT CENTER SAMPLE CODE REPOSITORY 
        foreach ($objResult in $colResults) 
        { 
            if($objResult.Properties[“Member”] -ne $null) 
            { 
                foreach ($member in $objResult.Properties[“Member”]) 
                { 
                    $indMember = [adsi] “LDAP://$member” 
                    $fullMemberName = $domain + ($indMember.Name) 
                    
                    #if($indMember[“objectclass”] 
                        # if child AD group continue down chain 
                        if(($indMember | Select-Object -ExpandProperty objectclass) -contains “group”) 
                        { 
                            Expand-ADGroupMembership -ADGroupName $fullMemberName 
                        } 
                        elseif(($indMember | Select-Object -ExpandProperty objectclass) -contains “user”) 
                        { 
                            Write-Output “<ADUser>$fullMemberName</ADUser>” 
                        } 
                } 
            } 
        } 
        
        Write-Output “</ADGroup>” 
    } 
} #end Expand-ADGroupMembership 
# main portion of script 
if((Get-PSSnapin -Name microsoft.sharepoint.powershell) -eq $null) 
{ 
    Add-PSSnapin Microsoft.SharePoint.PowerShell 
} 
$farm = Get-SPFarm 
Write-Output “<Farm Guid=`”$($farm.Id)`”>” 
$webApps = Get-SPWebApplication 
foreach($webApp in $webApps) 
{ 
    Write-Output “<WebApplication URL=`”$($webApp.URL)`” Name=`”$($webApp.Name)`”>” 
    foreach($site in $webApp.Sites) 
    { 
        Write-Output “<SiteCollection URL=`”$($site.URL)`”>” 
        
        foreach($web in $site.AllWebs) 
        { 
            Write-Output “<Site URL=`”$($web.URL)`”>” 
            # if site inherits permissions from parent then stop processing 
            if($web.HasUniqueRoleAssignments -eq $false) 
            { 
                Write-Output “<!– Inherits role assignments from parent –>” 
            } 
            # else site has unique permissions 
            else 
            { 
                foreach($assignment in $web.RoleAssignments) 
                { 
                    if(-not [string]::IsNullOrEmpty($assignment.Member.Xml)) 
                    { 
                        $roleBindings = ($assignment.RoleDefinitionBindings | Select-Object -ExpandProperty name) -join “,” 
                        # check if assignment is SharePoint Group 
                        if($assignment.Member.XML.StartsWith(‘<Group’) -eq “True”) 
                        { 
                            Write-Output “<SPGroup Name=`”$($assignment.Member.Name)`” RoleBindings=`”$roleBindings`”>” 
                            foreach($SPGroupMember in $assignment.Member.Users) 
                            { 
                                # if SharePoint group member is an AD Group 
                                if($SPGroupMember.IsDomainGroup) 
                                { 
                                    Expand-ADGroupMembership -ADGroupName $SPGroupMember.Name 
                                } 
                                # else SharePoint group member is an AD User 
                                else 
                                { 
                                    # remove claim portion of user login 
                                    #Write-Output “<ADUser>$($SPGroupMember.UserLogin.Remove(0,$SPGroupMember.UserLogin.IndexOf(“|”) + 1))</ADUser>” 
                                    Write-Output “<ADUser>$($SPGroupMember.UserLogin)</ADUser>” 
                                } 
                            } 
                            Write-Output “</SPGroup>” 
                        } 
                        # else an indivdually listed AD group or user 
                        else 
                        { 
                            if($assignment.Member.IsDomainGroup) 
                            { 
                                Expand-ADGroupMembership -ADGroupName $assignment.Member.Name -RoleBinding $roleBindings 
                            } 
                            else 
                            { 
                                # remove claim portion of user login 
                                #Write-Output “<ADUser>$($assignment.Member.UserLogin.Remove(0,$assignment.Member.UserLogin.IndexOf(“|”) + 1))</ADUser>” 
                                
                                Write-Output “<ADUser RoleBindings=`”$roleBindings`”>$($assignment.Member.UserLogin)</ADUser>” 
                            } 
                        } 
                    } 
                } 
            } 
            Write-Output “</Site>” 
            $web.Dispose() 
        } 
        Write-Output “</SiteCollection>” 
        $site.Dispose() 
    } 
    Write-Output “</WebApplication>” 
} 
Write-Output “</Farm>” 

   The output from the script can be sent to an XML which you can then explore using the [XML] type accelerator.  This lets you explore the XML structure however you see fit.  See the screenshot below for an example.

SP20102013Permissions1

 

   If you do view the XML output through a text editor (Notepad++ for me) notice the format.  Below we see a SharePoint site that has a SharePoint group Demo Members with Edit permissions assigned.  Demo Members has an AD group corpdevelopers as a member.  corpdevelopers has a child AD group called corpDevelopersSub with 1 AD user in that sub group.  As you can see the script recursively expands the AD hierarchy.

SP20102013Permissions2

 

Conclusion

   It took me 4 years to finally update this script but I‘m happy to get this published.  I was able to fix a number of errors and smooth out some rough edges.  I plan to develop this into a more full fledged tool over the next year with more features and flexibility (copy permissions, search for individual user or group, optional enumerate lists / items, etc.).  If you have any feedback, feature requests, or issues running it please let me know.  Enjoy the script!

 

      -Frog Out

The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

<Update 2013-07-01> This script has been
updated for SharePoint 2010 / 2013.  Please see my updated script and blog
post at PowerShell
Script to Enumerate SharePoint 2010 or 2013 Permissions and Active Directory
Group Membership
.

</Update 2013-07-01>

<Update>

Posting code didn’t format as well as hoped.  Download the below script here.

</Update>

 

     For those of you who are SharePoint admins or developers but have never dug into the SharePoint API or PowerShell, I would recommend first checking out some tutorials on both and referencing the SharePoint Developer Center.  At a later date I hope to be able to provide some quick demo scripts that highlight the power, time savings, and overall usefulness that can be gained by combining PowerShell and the SharePoint API.  For now though I wish to post a script I developed almost a year ago as a side project to combine a number of powerful features into one script.  To start, let me overview what the below script is capable of.

  1. Recursively crawl a site or entire web application within SharePoint
  2. Enumerate permissions assigned to a SharePoint site
  3. Detail the SharePoint users assigned to a SharePoint group
  4. Determine if an Active Directory group is a member of a SharePoint group
  5. Detail the Active Directory users who are members of an Active Directory group
  6. Search for a specific user’s permissions on a SharePoint site

     Before anyone says anything, yes I realize that combining so many utilities into one script is probably a bad design and I should’ve broken out functionality.  Yes this is probably true, but I want to state that this script was never intended for Production release.  Instead I was prototyping what was possible with PowerShell and I even surprised myself with what I ended up with.  Here is an attempt to visualize what the above hierarchy would look like.

–Site

——SharePoint User A

——SharePoint Group A

————SharePoint User B

————Active Directory Group A

——————Active Directory User A

——————Active Directory User B

     As you can see, this allows you to dig much further than what you might normally surface from the SharePoint API.  The true purpose of this script was to determine if a user was assigned permissions anywhere within a web application, even if indirectly by membership in a SharePoint group or Active Directory group.  This was only ever intended for a test environment, so you may still find some bugs when running against your own environment.

     Before running this, ensure that you have loaded the SharePoint assembly with the following call (typically placed into your PowerShell profile for ease of use):

[void][System.Reflection.Assembly]::LoadWithPartialName(“Microsoft.SharePoint”)

Please leave me feedback if you end up trying out this script or have any questions on how/why I wrote things the way I did.  I always enjoy constructive criticism and dialog.  If you do re-post this anywhere, be sure to include the reference to the source material for the Active Directory call portion as I borrowed it from the PowerShell Script Center.

Example call:

.DisplaySPWebApp6.ps1 http://server WebApp userA

   1:  ###########################################################
   2:  #DisplaySPWebApp6.ps1 -URL <string> -searchScope <string> -userToFind <string>
   3:  #
   4:  #Author: Brian Jackett
   5:  #Last Modified Date: Jan. 12, 2009
   6:  #
   7:  #Supply Traverse the entire web app site by site to display
   8:  # hierarchy and users with permissions to site.
   9:  ###########################################################
  10:   
  11:   
  12:  #DECLARE VARIABLES
  13:  [string]$siteUrl = $args[0]
  14:  [string]$searchScope = $args[1]
  15:  [string]$userToFind = $args[2]
  16:   
  17:  #DECLARE CONSTANTS
  18:  $BUFFER_CHARS = "   "
  19:   
  20:  function DetermineSpaceBuffer #-iterations <int>
  21:  {
  22:    [string]$spaceBuffer = ""
  23:    for($i = 0; $i -lt $args[0]; $i++)
  24:    {$spaceBuffer += $BUFFER_CHARS}
  25:   
  26:    return $spaceBuffer
  27:  }
  28:   
  29:  #DECLARE FUNCTIONS
  30:  function DrillDownADGroup #-group <[AD]DirectoryEntry> -depth <int>
  31:  {
  32:    [string]$spaceBuffer = DetermineSpaceBuffer $args[1]
  33:    $domain = $args[0].Name.substring(0, $args[0].Name.IndexOf("") + 1)
  34:    $groupName = $args[0].Name.Remove(0, $args[0].Name.IndexOf("") + 1)
  35:   
  36:    #BEGIN - CODE ADAPTED FROM SCRIPT CENTER SAMPLE CODE REPOSITORY
  37:    #http://www.microsoft.com/technet/scriptcenter/scripts/powershell/search/users/srch106.mspx
  38:   
  39:    #GET AD GROUP FROM DIRECTORY SERVICES SEARCH
  40:    $strFilter = "(&(objectCategory=Group)(name="+($groupName)+"))"
  41:    $objDomain = New-Object System.DirectoryServices.DirectoryEntry
  42:    $objSearcher = New-Object System.DirectoryServices.DirectorySearcher
  43:    $objSearcher.SearchRoot = $objDomain
  44:    $objSearcher.Filter = $strFilter
  45:   
  46:    #
  47:    $colProplist = ("name","member")
  48:    foreach ($i in $colPropList)
  49:    {
  50:      $catcher = $objSearcher.PropertiesToLoad.Add($i)
  51:    }
  52:    $colResults = $objSearcher.FindAll()
  53:   
  54:    #END - CODE ADAPTED FROM SCRIPT CENTER SAMPLE CODE REPOSITORY
  55:   
  56:   
  57:    foreach ($objResult in $colResults)
  58:    {
  59:      foreach ($member in $objResult.Properties.member)
  60:      {
  61:        $indMember = [adsi] "LDAP://$member"
  62:        
  63:        #ATTEMPT TO GET AD OBJECT TYPE FOR USER, NOT WORKING RIGHT NOW
  64:        #$user = $indMember.PSBase
  65:        #$user.Properties
  66:   
  67:        $fullUserName = $domain + ($indMember.Name)
  68:        DisplayADEntry $fullUserName ($args[1])
  69:      }
  70:    }
  71:  }
  72:   
  73:  function DisplaySPGroupMembers #-group <SPGroup> -depth <int>
  74:  {
  75:    [string]$spaceBuffer = DetermineSpaceBuffer $args[1]
  76:   
  77:    if($args[0].Users -ne $Null)
  78:    {
  79:      #START SHAREPOINT USERS ENTITY
  80:      Write-Output $spaceBuffer"<SPUsers>"
  81:    
  82:      foreach($user in $args[0].Users)
  83:      {
  84:        DisplayADEntry $user ($args[1] + 1)
  85:      }
  86:   
  87:      #END SHAREPOINT USERS ENTITY
  88:      Write-Output $spaceBuffer"</SPUsers>"
  89:    }
  90:  }
  91:   
  92:  function DisplayADEntry #-user/group <SPUser> -depth <int>
  93:  {
  94:    #FILTER RESULTS IF LOOKING FOR SPECIFIC USER
  95:    if($args[0].IsDomainGroup -eq "True")
  96:    {
  97:      $outputText = "$spaceBuffer$BUFFER_CHARS<Group>" + ($args[0])
  98:      Write-Output $outputText
  99:      DrillDownADGroup $args[0] ($args[1])
 100:      $outputText = "$spaceBuffer$BUFFER_CHARS</Group>" 
 101:      Write-Output $outputText
 102:    }
 103:    else
 104:    {
 105:      #USER FOUND AS A CHILD OF AN EMBEDDED AD GROUP
 106:      if(($userToFind -ne "" -and ($userToFind.ToUpper() -eq $args[0].LoginName.ToUpper() -or $userToFind.ToUpper() -eq $args[0].ToUpper())) -or $userToFind -eq "")
 107:      {
 108:        $outputText = "$spaceBuffer$BUFFER_CHARS<User>" + ($args[0]) + "</User>"
 109:        Write-Output $outputText
 110:      }
 111:    }
 112:  }
 113:   
 114:  function DetermineUserAccess #-web <SPWeb> -depth <int>
 115:  {
 116:    [string]$spaceBuffer = DetermineSpaceBuffer $args[1]
 117:   
 118:    #START SHAREPOINT GROUPS ENTITY
 119:    Write-Output "$spaceBuffer<SPGroups>"
 120:   
 121:    foreach($perm in $args[0].Permissions)
 122:    {
 123:      #CHECK IF MEMBER IS AN ACTIVE DIRECTORY ENTRY OR SHAREPOINT GROUP
 124:      if($perm.XML.Contains('MemberIsUser="True"') -eq "True")
 125:      {
 126:        DisplayADEntry $perm.Member ($args[1] + 1)
 127:      }
 128:      #IS A SHAREPOINT GROUP
 129:      else
 130:      {
 131:        $outputText = "$spaceBuffer$BUFFER_CHARS<SPGroup>" + ($perm.Member)
 132:        Write-Output $outputText
 133:        DisplaySPGroupMembers $perm.Member ($args[1] + 2)
 134:        Write-Output "$spaceBuffer$BUFFER_CHARS</SPGroup>"
 135:      }
 136:    }
 137:   
 138:    #END SHAREPOINT GROUPS ENTITY
 139:    Write-Output "$spaceBuffer</SPGroups>"
 140:  }
 141:   
 142:  function DisplayWebApplication #-webApp <SPWebApplication>
 143:  {
 144:    [string]$spaceBuffer = DetermineSpaceBuffer $args[1]
 145:   
 146:    #START WEB APPLICATION ENTITY
 147:    $outputText = "$spaceBuffer<Web Application>" + ($args[0].Name)
 148:    Write-Output $outputText
 149:   
 150:    if($args[0].Sites -ne $Null)
 151:    {
 152:      #START CONTAINED SITE COLLECTIONS ENTITY
 153:      Write-Output "$spaceBuffer$BUFFER_CHARS<Site Collections>"
 154:   
 155:      foreach($spSiteColl in $args[0].Sites)
 156:      {
 157:        DisplaySiteCollection $spSiteColl ($args[1] + 2)
 158:        $spSiteColl.Dispose()
 159:      }
 160:   
 161:      #END CONTAINED SITE COLLECTIONS ENTITY
 162:      Write-Output "$spaceBuffer$BUFFER_CHARS</SiteCollections>"
 163:    }
 164:   
 165:    #END WEB APPLICATION ENTITY
 166:    "$spaceBuffer</Web Application>"
 167:  }
 168:   
 169:  function DisplaySiteCollection #-siteColl <SPSiteCollection> -depth <int>
 170:  {
 171:    [string]$spaceBuffer = DetermineSpaceBuffer $args[1]
 172:    $sc = $args[0].OpenWeb()
 173:   
 174:    #START SITE COLLECTION ENTITY
 175:    $outputText = "$spaceBuffer<Site Collection>" + ($sc.URL)
 176:    Write-Output $outputText
 177:   
 178:    if($sc -ne $Null)
 179:    {
 180:      #START CONTAINED SITES ENTITY
 181:      Write-Output "$spaceBuffer$BUFFER_CHARS<Sites>"
 182:   
 183:      foreach ($spWeb in $sc)
 184:      {
 185:        DisplayWeb $spWeb ($args[1] + 2)
 186:        $spWeb.Dispose()
 187:      }
 188:   
 189:      #END CONTAINED SITES ENTITY
 190:      Write-Output "$spaceBuffer$BUFFER_CHARS</Sites>"
 191:    }
 192:   
 193:    #END SITE COLLECTION ENTITY
 194:    Write-Output "$spaceBuffer</Site Collection>"
 195:   
 196:    #CLEANUP SITE COLLECTION VARIABLE
 197:    $sc.Dispose()
 198:  }
 199:   
 200:  function DisplayWeb #-web <SPWeb> -depth <int> -parentWeb <SPWeb>
 201:  {
 202:    [string]$spaceBuffer = DetermineSpaceBuffer $args[1]
 203:   
 204:    #START SITE ENTITY
 205:    $outputText = "$spaceBuffer<Site>" + ($args[0].URL)
 206:    Write-Output $outputText
 207:    
 208:    if($args[0].HasUniquePerm -eq "True")
 209:    {
 210:      DetermineUserAccess $args[0] ($args[1] + 1)
 211:    }
 212:    else
 213:    {
 214:      Write-Output "$spaceBuffer<!--Inherits from parent>"
 215:    }
 216:   
 217:   
 218:    if($args[0].Webs -ne $Null)
 219:    {
 220:      #START CONTAINED SUBSITES ENTITY
 221:      Write-Output "$spaceBuffer$BUFFER_CHARS<Subsites>"
 222:   
 223:      #RECURSIVELY SEARCH SUBWEBS
 224:      foreach ($spSubWeb in $args[0].Webs)
 225:      {
 226:        DisplayWeb $spSubWeb ($args[1] + 2)
 227:        $spSubWeb.Dispose()
 228:      }
 229:      #END CONTAINED SUBSITES ENTITY
 230:      Write-Output "$spaceBuffer$BUFFER_CHARS</Subsites>"
 231:    }
 232:   
 233:    #END SITE ENTITY
 234:    Write-Output "$spaceBuffer</Site>"
 235:  }
 236:   
 237:  function DisplayMissingParametersMessage
 238:  {
 239:    #Write-Output "You are missing a parameter for 'Site URL'"
 240:    $script:siteURL = Read-Host "Enter Site URL"
 241:  }
 242:   
 243:  ############
 244:  # MAIN
 245:  ############
 246:   
 247:  #IF MISSING PARM FOR SITE URL, ASK FOR INPUT TO FILL
 248:  if($args.length -eq 0)
 249:  {
 250:    DisplayMissingParametersMessage
 251:  }
 252:   
 253:  $rootSite = New-Object Microsoft.SharePoint.SPSite($siteUrl)
 254:  $spWebApp = $rootSite.WebApplication
 255:   
 256:   
 257:  Write-Output "<Web Applications>"
 258:   
 259:  #IF SEARCH SCOPE SPECIFIED FOR SITE, ONLY SEARCH SITE
 260:  if($searchScope -eq "-site")
 261:  {
 262:    DisplaySiteCollection $rootSite 1
 263:  }
 264:  #ELSE SEARCH ENTIRE WEB APP
 265:  else
 266:  {
 267:    DisplayWebApplication $spWebApp 1
 268:  }
 269:  Write-Output "</Web Applications>"
 270:   
 271:   
 272:  #CLEANUP
 273:  $rootSite.Dispose()