<Update 2013-07-01> This script has been updated for SharePoint 2010 / 2013. Please see my updated script and blog post at PowerShell
Script to Enumerate SharePoint 2010 or 2013 Permissions and Active Directory
Group Membership.
</Update 2013-07-01>
<Update>
Posting code didn’t format as well as hoped. Download the below script here.
</Update>
For those of you who are SharePoint admins or developers but have never dug into the SharePoint API or PowerShell, I would recommend first checking out some tutorials on both and referencing the SharePoint Developer Center. At a later date I hope to be able to provide some quick demo scripts that highlight the power, time savings, and overall usefulness that can be gained by combining PowerShell and the SharePoint API. For now though I wish to post a script I developed almost a year ago as a side project to combine a number of powerful features into one script. To start, let me overview what the below script is capable of.
- Recursively crawl a site or entire web application within SharePoint
- Enumerate permissions assigned to a SharePoint site
- Detail the SharePoint users assigned to a SharePoint group
- Determine if an Active Directory group is a member of a SharePoint group
- Detail the Active Directory users who are members of an Active Directory group
- Search for a specific user’s permissions on a SharePoint site
Before anyone says anything, yes I realize that combining so many utilities into one script is probably a bad design and I should’ve broken out functionality. Yes this is probably true, but I want to state that this script was never intended for Production release. Instead I was prototyping what was possible with PowerShell and I even surprised myself with what I ended up with. Here is an attempt to visualize what the above hierarchy would look like.
–Site
——SharePoint User A
——SharePoint Group A
————SharePoint User B
————Active Directory Group A
——————Active Directory User A
——————Active Directory User B
As you can see, this allows you to dig much further than what you might normally surface from the SharePoint API. The true purpose of this script was to determine if a user was assigned permissions anywhere within a web application, even if indirectly by membership in a SharePoint group or Active Directory group. This was only ever intended for a test environment, so you may still find some bugs when running against your own environment.
Before running this, ensure that you have loaded the SharePoint assembly with the following call (typically placed into your PowerShell profile for ease of use):
[void][System.Reflection.Assembly]::LoadWithPartialName(“Microsoft.SharePoint”)
Please leave me feedback if you end up trying out this script or have any questions on how/why I wrote things the way I did. I always enjoy constructive criticism and dialog. If you do re-post this anywhere, be sure to include the reference to the source material for the Active Directory call portion as I borrowed it from the PowerShell Script Center.
Example call:
.DisplaySPWebApp6.ps1 http://server WebApp userA
Note: The below script does not format properly through WordPress after I migrated my blog. Please refer to the source script for better view.
###########################################################
#DisplaySPWebApp6.ps1 -URL -searchScope -userToFind
#
#Author: Brian Jackett
#Last Modified Date: Jan. 12, 2009
#
#Supply Traverse the entire web app site by site to display
# hierarchy and users with permissions to site.
###########################################################
#DECLARE VARIABLES
[string]$siteUrl = $args[0]
[string]$searchScope = $args[1]
[string]$userToFind = $args[2]
#DECLARE CONSTANTS
$BUFFER_CHARS = " "
function DetermineSpaceBuffer #-iterations
{
[string]$spaceBuffer = ""
for($i = 0; $i -lt $args[0]; $i++)
{$spaceBuffer += $BUFFER_CHARS}
return $spaceBuffer
}
#DECLARE FUNCTIONS
function DrillDownADGroup #-group -depth
{
[string]$spaceBuffer = DetermineSpaceBuffer $args[1]
$domain = $args[0].Name.substring(0, $args[0].Name.IndexOf("\") + 1)
$groupName = $args[0].Name.Remove(0, $args[0].Name.IndexOf("\") + 1)
#BEGIN - CODE ADAPTED FROM SCRIPT CENTER SAMPLE CODE REPOSITORY
#http://www.microsoft.com/technet/scriptcenter/scripts/powershell/search/users/srch106.mspx
#GET AD GROUP FROM DIRECTORY SERVICES SEARCH
$strFilter = "(&(objectCategory=Group)(name="+($groupName)+"))"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.Filter = $strFilter
#
$colProplist = ("name","member")
foreach ($i in $colPropList)
{
$catcher = $objSearcher.PropertiesToLoad.Add($i)
}
$colResults = $objSearcher.FindAll()
#END - CODE ADAPTED FROM SCRIPT CENTER SAMPLE CODE REPOSITORY
foreach ($objResult in $colResults)
{
foreach ($member in $objResult.Properties.member)
{
$indMember = [adsi] "LDAP://$member"
#ATTEMPT TO GET AD OBJECT TYPE FOR USER, NOT WORKING RIGHT NOW
#$user = $indMember.PSBase
#$user.Properties
$fullUserName = $domain + ($indMember.Name)
DisplayADEntry $fullUserName ($args[1])
}
}
}
function DisplaySPGroupMembers #-group -depth
{
[string]$spaceBuffer = DetermineSpaceBuffer $args[1]
if($args[0].Users -ne $Null)
{
#START SHAREPOINT USERS ENTITY
Write-Output $spaceBuffer""
foreach($user in $args[0].Users)
{
DisplayADEntry $user ($args[1] + 1)
}
#END SHAREPOINT USERS ENTITY
Write-Output $spaceBuffer""
}
}
function DisplayADEntry #-user/group -depth
{
#FILTER RESULTS IF LOOKING FOR SPECIFIC USER
if($args[0].IsDomainGroup -eq "True")
{
$outputText = "$spaceBuffer$BUFFER_CHARS" + ($args[0])
Write-Output $outputText
DrillDownADGroup $args[0] ($args[1])
$outputText = "$spaceBuffer$BUFFER_CHARS"
Write-Output $outputText
}
else
{
#USER FOUND AS A CHILD OF AN EMBEDDED AD GROUP
if(($userToFind -ne "" -and ($userToFind.ToUpper() -eq $args[0].LoginName.ToUpper() -or $userToFind.ToUpper() -eq $args[0].ToUpper())) -or $userToFind -eq "")
{
$outputText = "$spaceBuffer$BUFFER_CHARS" + ($args[0]) + ""
Write-Output $outputText
}
}
}
function DetermineUserAccess #-web -depth
{
[string]$spaceBuffer = DetermineSpaceBuffer $args[1]
#START SHAREPOINT GROUPS ENTITY
Write-Output "$spaceBuffer"
foreach($perm in $args[0].Permissions)
{
#CHECK IF MEMBER IS AN ACTIVE DIRECTORY ENTRY OR SHAREPOINT GROUP
if($perm.XML.Contains('MemberIsUser="True"') -eq "True")
{
DisplayADEntry $perm.Member ($args[1] + 1)
}
#IS A SHAREPOINT GROUP
else
{
$outputText = "$spaceBuffer$BUFFER_CHARS" + ($perm.Member)
Write-Output $outputText
DisplaySPGroupMembers $perm.Member ($args[1] + 2)
Write-Output "$spaceBuffer$BUFFER_CHARS"
}
}
#END SHAREPOINT GROUPS ENTITY
Write-Output "$spaceBuffer"
}
function DisplayWebApplication #-webApp
{
[string]$spaceBuffer = DetermineSpaceBuffer $args[1]
#START WEB APPLICATION ENTITY
$outputText = "$spaceBuffer" + ($args[0].Name)
Write-Output $outputText
if($args[0].Sites -ne $Null)
{
#START CONTAINED SITE COLLECTIONS ENTITY
Write-Output "$spaceBuffer$BUFFER_CHARS"
foreach($spSiteColl in $args[0].Sites)
{
DisplaySiteCollection $spSiteColl ($args[1] + 2)
$spSiteColl.Dispose()
}
#END CONTAINED SITE COLLECTIONS ENTITY
Write-Output "$spaceBuffer$BUFFER_CHARS"
}
#END WEB APPLICATION ENTITY
"$spaceBuffer"
}
function DisplaySiteCollection #-siteColl -depth
{
[string]$spaceBuffer = DetermineSpaceBuffer $args[1]
$sc = $args[0].OpenWeb()
#START SITE COLLECTION ENTITY
$outputText = "$spaceBuffer" + ($sc.URL)
Write-Output $outputText
if($sc -ne $Null)
{
#START CONTAINED SITES ENTITY
Write-Output "$spaceBuffer$BUFFER_CHARS"
foreach ($spWeb in $sc)
{
DisplayWeb $spWeb ($args[1] + 2)
$spWeb.Dispose()
}
#END CONTAINED SITES ENTITY
Write-Output "$spaceBuffer$BUFFER_CHARS"
}
#END SITE COLLECTION ENTITY
Write-Output "$spaceBuffer"
#CLEANUP SITE COLLECTION VARIABLE
$sc.Dispose()
}
function DisplayWeb #-web -depth -parentWeb
{
[string]$spaceBuffer = DetermineSpaceBuffer $args[1]
#START SITE ENTITY
$outputText = "$spaceBuffer" + ($args[0].URL)
Write-Output $outputText
if($args[0].HasUniquePerm -eq "True")
{
DetermineUserAccess $args[0] ($args[1] + 1)
}
else
{
Write-Output "$spaceBuffer<!--Inherits from parent>-->"
}
if($args[0].Webs -ne $Null)
{
#START CONTAINED SUBSITES ENTITY
Write-Output "$spaceBuffer$BUFFER_CHARS"
#RECURSIVELY SEARCH SUBWEBS
foreach ($spSubWeb in $args[0].Webs)
{
DisplayWeb $spSubWeb ($args[1] + 2)
$spSubWeb.Dispose()
}
#END CONTAINED SUBSITES ENTITY
Write-Output "$spaceBuffer$BUFFER_CHARS"
}
#END SITE ENTITY
Write-Output "$spaceBuffer"
}
function DisplayMissingParametersMessage
{
#Write-Output "You are missing a parameter for 'Site URL'"
$script:siteURL = Read-Host "Enter Site URL"
}
############
# MAIN
############
#IF MISSING PARM FOR SITE URL, ASK FOR INPUT TO FILL
if($args.length -eq 0)
{
DisplayMissingParametersMessage
}
$rootSite = New-Object Microsoft.SharePoint.SPSite($siteUrl)
$spWebApp = $rootSite.WebApplication
Write-Output ""
#IF SEARCH SCOPE SPECIFIED FOR SITE, ONLY SEARCH SITE
if($searchScope -eq "-site")
{
DisplaySiteCollection $rootSite 1
}
#ELSE SEARCH ENTIRE WEB APP
else
{
DisplayWebApplication $spWebApp 1
}
Write-Output ""
#CLEANUP
$rootSite.Dispose()
The Frog Pond of Technology 