Introduction

Consider a scenario where you need to add users to the user policy for multiple web applications in multiple Farms. PowerShell is useful for that. In this article I will outline how to add users or groups to a SharePoint web application user's policy.

Preparation

Before executing the script you must first identify the users and groups that need to be added to multiple web applications in the SharePoint Farm. Group the web application list into a text file (WebapplicationList.txt). The script parses through this input file and adds the users or groups to the user policy of each web application in the list.

Functionality

The script provides options to do the following tasks:

  1. Grant FULL CONTROL access
  2. Grant FULL READ access
  3. DENY WRITE
  4. DENY ALL

Function 1

The following piece of code helps you to provide “FULL CONTROL” access:

  1. Function FullControl()
  2. {
  3. $UserOrGroup = read-host "Enter the user or group for which you want to apply FULL CONTROL (e.g domain\user) "
  4. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  5. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  6. if($Didyouplacethefile -eq 'y')
  7. {
  8. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  9. if($testpath)
  10. {
  11. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  12. {
  13. $webapp = get-spwebapplication $webapplication
  14. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing FULL CONTROL access" -fore yellow
  15. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  16. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::FullControl)
  17. $policy.PolicyRoleBindings.Add($policyRole)
  18. $webApp.Update()
  19. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  20. }
  21. }
  22. else
  23. {
  24. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  25. }
  26. }
  27. else
  28. {
  29. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  30. }
  31. }

Function 2

The following piece of code helps you to provide “FULL READ” access:

  1. Function FullRead()
  2. {
  3. $UserOrGroup = read-host "Enter the user or group for which you want to apply FULL READ (e.g domain\user) "
  4. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  5. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  6. if($Didyouplacethefile -eq 'y')
  7. {
  8. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  9. if($testpath)
  10. {
  11. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  12. {
  13. $webapp = get-spwebapplication $webapplication
  14. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing FULL READ access" -fore yellow
  15. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  16. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::FullRead)
  17. $policy.PolicyRoleBindings.Add($policyRole)
  18. $webApp.Update()
  19. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  20. }
  21. }
  22. else
  23. {
  24. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  25. }
  26. }
  27. else
  28. {
  29. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  30. }
  31. }
Function 3

The following piece of code helps you to provide “DENY WRITE” access:

  1. Function DenyWrite()
  2. {
  3. $UserOrGroup = read-host "Enter the user or group for which you want to apply DENY WRITE (e.g domain\user) "
  4. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  5. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  6. if($Didyouplacethefile -eq 'y')
  7. {
  8. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  9. if($testpath)
  10. {
  11. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  12. {
  13. $webapp = get-spwebapplication $webapplication
  14. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing DENY WRITE access" -fore yellow
  15. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  16. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::DenyWrite)
  17. $policy.PolicyRoleBindings.Add($policyRole)
  18. $webApp.Update()
  19. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  20. }
  21. }
  22. else
  23. {
  24. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  25. }
  26. }
  27. else
  28. {
  29. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  30. }
  31. }

Function 4

The following piece of code helps you to provide “DENY ALL” access:

  1. Function DenyAll()
  2. {
  3. $UserOrGroup = read-host "Enter the user or group for which you want to apply DENY ALL (e.g domain\user) "
  4. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  5. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  6. if($Didyouplacethefile -eq 'y')
  7. {
  8. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  9. if($testpath)
  10. {
  11. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  12. {
  13. $webapp = get-spwebapplication $webapplication
  14. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing DENY ALL access" -fore yellow
  15. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  16. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::DenyAll)
  17. $policy.PolicyRoleBindings.Add($policyRole)
  18. $webApp.Update()
  19. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  20. }
  21. }
  22. else
  23. {
  24. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  25. }
  26. }
  27. else
  28. {
  29. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  30. }
  31. }

Complete Code

  1. $LogTime = Get-Date -Format yyyy-MM-dd_hh-mm
  2. $LogFile = ".\AddUserOrGroupToWebAppPolicyPatch-$LogTime.rtf"
  4. # Add SharePoint PowerShell Snapin
  6. if ( (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue) -eq $null ) {
  7. Add-PSSnapin Microsoft.SharePoint.Powershell
  8. }
  10. $scriptBase = split-path $SCRIPT:MyInvocation.MyCommand.Path -parent
  11. Set-Location $scriptBase
  13. #Deleting any .rtf files in the scriptbase location
  14. $FindRTFFile = Get-ChildItem $scriptBase\*.* -include *.rtf
  15. if($FindRTFFile)
  16. {
  17. foreach($file in $FindRTFFile)
  18. {
  19. remove-item $file
  20. }
  21. }
  23. start-transcript $logfile
  25. Function FullRead()
  26. {
  27. $UserOrGroup = read-host "Enter the user or group for which you want to apply FULL READ (e.g domain\user) "
  28. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  29. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  30. if($Didyouplacethefile -eq 'y')
  31. {
  32. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  33. if($testpath)
  34. {
  35. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  36. {
  37. $webapp = get-spwebapplication $webapplication
  38. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing FULL READ access" -fore yellow
  39. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  40. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::FullRead)
  41. $policy.PolicyRoleBindings.Add($policyRole)
  42. $webApp.Update()
  43. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  44. }
  45. }
  46. else
  47. {
  48. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  49. }
  50. }
  51. else
  52. {
  53. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  54. }
  55. }
  57. Function FullControl()
  58. {
  59. $UserOrGroup = read-host "Enter the user or group for which you want to apply FULL CONTROL (e.g domain\user) "
  60. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  61. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  62. if($Didyouplacethefile -eq 'y')
  63. {
  64. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  65. if($testpath)
  66. {
  67. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  68. {
  69. $webapp = get-spwebapplication $webapplication
  70. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing FULL CONTROL access" -fore yellow
  71. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  72. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::FullControl)
  73. $policy.PolicyRoleBindings.Add($policyRole)
  74. $webApp.Update()
  75. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  76. }
  77. }
  78. else
  79. {
  80. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  81. }
  82. }
  83. else
  84. {
  85. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  86. }
  87. }
  89. Function DenyWrite()
  90. {
  91. $UserOrGroup = read-host "Enter the user or group for which you want to apply DENY WRITE (e.g domain\user) "
  92. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  93. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  94. if($Didyouplacethefile -eq 'y')
  95. {
  96. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  97. if($testpath)
  98. {
  99. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  100. {
  101. $webapp = get-spwebapplication $webapplication
  102. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing DENY WRITE access" -fore yellow
  103. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  104. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::DenyWrite)
  105. $policy.PolicyRoleBindings.Add($policyRole)
  106. $webApp.Update()
  107. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  108. }
  109. }
  110. else
  111. {
  112. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  113. }
  114. }
  115. else
  116. {
  117. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  118. }
  119. }
  121. Function DenyAll()
  122. {
  123. $UserOrGroup = read-host "Enter the user or group for which you want to apply DENY ALL (e.g domain\user) "
  124. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  125. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  126. if($Didyouplacethefile -eq 'y')
  127. {
  128. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  129. if($testpath)
  130. {
  131. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  132. {
  133. $webapp = get-spwebapplication $webapplication
  134. write-host "Adding user or group " $userorgroup " to the webapplication " $webapplication "user policy and providing DENY ALL access" -fore yellow
  135. $policy = $webApp.Policies.Add($userOrGroup, $userOrGroup)
  136. $policyRole = $webApp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::DenyAll)
  137. $policy.PolicyRoleBindings.Add($policyRole)
  138. $webApp.Update()
  139. write-host "User or group " $userorgroup " added to the webapplication " $webapplication -fore green
  140. }
  141. }
  142. else
  143. {
  144. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  145. }
  146. }
  147. else
  148. {
  149. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  150. }
  151. }
  153. write-host "########################################################################################################" -fore cyan
  154. write-host "Enter 1 to provide FULL READ access" -fore green
  155. write-host "Enter 2 to provide FULL CONTROL access" -fore green
  156. write-host "Enter 3 to DENY WRITE access" -fore green
  157. write-host "Enter 4 to DENY ALL access" -fore green
  158. write-host "########################################################################################################" -fore cyan
  159. $option = read-host "Enter the option "
  160. switch($option)
  161. {
  162. 1{
  163. FullRead
  164. }
  165. 2{
  166. FullControl
  167. }
  168. 3{
  169. DenyWrite
  170. }
  171. 4{
  172. DenyAll
  173. }
  174. }
  175. write-host ""
  176. write-host "SCRIPT COMPLETED" -fore Blue
  177. stop-transcript

Execution Procedure

Step 1: Download and copy the script to your SharePoint server. Populate the input file (WebapplicationList.txt) with the web application details and place it under the same location where the script exists.

Step 2: Navigate to the script path.

Step 3: Execute the script as in the following:



Enter option 1 or 2 or 3 or 4 to get the desired output.

Conclusion

Thus this article provides an outline for how to add users or groups to a web application's user policy using a PowerShell script.