This script is posted as part of our MSPress Book that will be released in 2013.
You can use this script to send site owners the list of permissions in each site that they must validate every set number of days:
function SendEmail($emailTo, $body)
{
$emailFrom = "sharepoint@contoso.com"
$subject = "60-Day SharePoint Permissions Review"
$smtpServer = "smtp.contoso.com"
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom, $emailTo, $subject, $body)
}
function GetPermissions($web)
{
$permissions = new-object system.text.stringbuilder
[void]$permissions.appendline("Please review your site's, " + $web.url + ", permissions and remove anyone that no longer needs access")
[void]$permissions.appendline("")
[void]$permissions.appendline("Web Groups:")
[void]$permissions.appendline("")
foreach($group in $web.groups)
{
if ($group.users.count -gt 0)
{
[void] $permissions.appendline("`tGroup Name: " + $group.name)
[void] $permissions.appendline("`tGroup Owner: " + $group.Owner)
[void] $permissions.appendline("`tGroup Members: ")
foreach($user in $group.Users)
{
[void]$permissions.appendline("`t`t" + $user.userlogin)
}
}
}
[void]$permissions.appendline("")
[void]$permissions.appendline("Web Permissions:")
[void]$permissions.appendline("")
foreach($ass in $web.roleassignments)
{
[void]$permissions.appendline("`tUser/Group:" + $ass.member.tostring())
foreach($def in $ass.roledefinitionbindings)
{
[void]$permissions.appendline("`t`t" + $def.name)
}
}
[void]$permissions.appendline("")
[void]$permissions.appendline("Unique List Permissions:")
[void]$permissions.appendline("")
foreach($list in $web.lists)
{
if ($list.hasuniqueroleassignments)
{
[void] $permissions.appendline("`tList (unique perms)" + $list.title)
foreach($ass in $list.roleassignments)
{
[void]$permissions.appendline("`tUser/Group:" + $ass.member.tostring())
foreach($def in $ass.roledefinitionbindings)
{
[void]$permissions.appendline("`t`t" + $def.name)
}
}
}
}
return $permissions
}
add-pssnapin microsoft.sharepoint.powershell
$webapps = get-spwebapplication
foreach($wa in $webapps)
{
foreach($site in $wa.sites)
{
"Processing " + $site.url
if ($site.url.tolower().startswith("http://my.contoso.com"))
{
continue;
}
foreach($web in $site.allwebs)
{
"Processing " + $web.url
$date = $web.properties["PermissionReminderDate"]
if (!$date)
{
"Setting empty date"
$web.properties["PermissionReminderDate"] = [System.DateTime]::Now.toshortdatestring()
$web.properties.update()
$date = $web.properties["PermissionReminderDate"].tostring()
}
$remindDate = [System.DateTime]::Parse($date)
"Date is " + $reminddate
if ($remindDate -lt [System.DateTime]::Now)
{
"Sending permissions reminder to " + $web.author.userlogin + " for web " + $web.url
#generate the permissions info
$permissions = GetPermissions $web
SendEmail $web.author.email $permissions
$web.properties["PermissionReminderDate"] = [System.DateTime]::Now.adddays(60).toshortdatestring()
$web.properties.update()
}
#[system.console]::readline()
}
}
}
Enjoy!
CJG