PowerShell Script To Cleanup Site Collection Administrator

Objective

This purpose of this document is to mention the steps to cleanup site collection administrator from site collection administrator group using PowerShell script. The reusable script for this job has also attached with this document.

This script offers

• To read a set of site collections, which we want to exclude/include in this process, from a configurable XML file.
• Configure a set of users with their login id, whom you want to remove from Site Collection Administrator group.

Business Case

S. No.

Business Case

1

For several reasons (Some application troubleshooting, Deployment,Migration, Testing etc.) SharePoint Support team requires an access toPROD site collections. Most of the time we forgot to revoke access ofthese users from PROD sites which may result into access matrixviolation for Customer. However, there are some test site collectionwhich we use for testing purpose for offshore development team, we wantteam to have an access to only those test Site collection. This scriptwill allow administrator to do this job just by configuring the XMLfile.

Targeted Audience

• SharePoint Application Developers
• SharePoint Administrator
• SharePoint Architect

Offerings

• One reusable PowerShell script is provided which needs to be run to cleanup a setoff users from site collection administrator group.
  
• Format of XML file is provided where site collection (which you want to exclude/include) needs to be configured.
  
• Configure a list of users with their login id in provided XML format.

Technical Details

Below are the technical details for this PowerShell script,

1. Pre-requisites
   
   
   • Login to server with Farm administrator account and copy the folder and paste the same to the location where you want to keep it.
     
     
   • Open the folder and Configure XML file as per your requirement.
     

     <?xml version="1.0" encoding="utf-8" ?>
     <Configuration Environment="DEV" Version="1.0.0.0">
       <GlobalWebApplications>
         <GlobalWebApplication url="http://myWebApplication" SitesToExclude="False">
         <SiteCollections>
                 <SiteCollection relativeURL="sites/TeamSite"></SiteCollection>
             <SiteCollection relativeURL="Sites/ProjectSite"></SiteCollection>
             </SiteCollections>
           <UsersToCleanup>
             <User UserLogin="i:0#.w|Domain\LoginId"></User>
         <User UserLogin="i:0#.w|Domain\LoginId"></User>
           </UsersToCleanup>
         </GlobalWebApplication>
       </GlobalWebApplications>
     </Configuration>

   As shown in above image;
   

   • Enter Web Application URL.
   • Define SitesToExculde Tag to True/False
     
     
     • True
       
       If we configure this attribute value to True; which means we want to exclude the below configured site collections in this process. So that the cleanup activity will not work on this Site Collections.
       
       
     • False
       
       If we configure this attribute value to False; which means we want to include the below configured site collections in this process. So that the cleanup activity will work on all other Site Collections but not on those which are configured in XML.
     
     
   • Configure a set of Site collection relative URL which you want to exclude form this cleanup activity.
   • Configure a list of users which you want to cleanup from Site Collection Administrator group.
     
     Note: Name the file as Configuration.xml only.
     
     
2. Execution
   
   Prerequisite:
   
   Login to SharePoint Server as Farm Administrator and copy the required files (PowerShell script and configuration XML).Configure the XML file as per your requirement.
   
   Run:
   
   
   • Run the PowerShell Script as “Run as Administrator“.
     
     
   • Browse the folder path where you have kept this PowerShell script file and execute a command as shown in below image.
     
     
     

PowerShell Script

##########################################################################################################################
######## V 1.0
######## PowerShell Script to Cleanup not required admins form Site Collection other than those defined in Config file
##########################################################################################################################

#check to see if the PowerShell Snapin is added
if((Get-PSSnapin | Where {$_.Name -eq "Microsoft.SharePoint.PowerShell"}) -eq $null) {
    Add-PSSnapin Microsoft.SharePoint.PowerShell;
}

## SharePoint DLL
[void][System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint")
$global:currentPhysicalPath = Split-Path ((Get-Variable MyInvocation -Scope 0).Value).MyCommand.Path
[xml]$xmlinput = (Get-Content "$global:currentPhysicalPath\Configuration.xml")


function Global_CleanUpAdminsFromSiteCollections([xml]$xmlinput)
{
   foreach($configWebApp in $xmlinput.Configuration.GlobalWebApplications.GlobalWebApplication)
   {
        $webApp = Get-SPWebApplication $configWebApp.url -ErrorAction silentlycontinue
        $Choice = $configWebApp.SitesToExclude
        if($webApp -eq $null)
        {
             Write-host Web Application at url : $configWebApp.url does not Exists.. -foregroundcolor Red
        }
        else
        {
            $AllSiteCollections = $webApp | Get-SPSite -Limit ALL
            if($choice.ToString().ToLower() -eq "true")
            {
                $SiteCollectionsToExclude = $AllSiteCollections
                foreach($siteColl in $xmlinput.Configuration.GlobalWebApplications.GlobalWebApplication.SiteCollections.SiteCollection)
                {
                    $SiteCollectionsToExclude = $SiteCollectionsToExclude | Where-Object {$_.url -ne $($webApp.url + $siteColl.relativeUrl) }
                }

                foreach($UserID in $xmlinput.Configuration.GlobalWebApplications.GlobalWebApplication.UsersToCleanup.User)
                {
                    foreach($SiteCollection in $SiteCollectionsToExclude)
                    {
                        # Remove Site Collection Admin function call
                        RemoveSiteCollAdmin $UserID.UserLogin $SiteCollection.url
                    }
                }
            }
            else
            {
                $SiteCollectionsToInclude = @()
                if($choice.ToString().ToLower() -eq "false")
                {
                    foreach($siteColl in $xmlinput.Configuration.GlobalWebApplications.GlobalWebApplication.SiteCollections.SiteCollection)
                    {
                        foreach($site in $AllSiteCollections)
                        {
                            if($site.url -eq $($webApp.url + $siteColl.relativeUrl))
                            {
                                $SiteCollectionsToInclude =  $SiteCollectionsToInclude + $($webApp.url + $siteColl.relativeUrl);
                            }
                        }
                    }

                    foreach($UserID in $xmlinput.Configuration.GlobalWebApplications.GlobalWebApplication.UsersToCleanup.User)
                    {
                        foreach($SiteCollection in $SiteCollectionsToInclude)
                        {
                            # Remove Site Collection Admin function call
                            RemoveSiteCollAdmin $UserID.UserLogin $SiteCollection
                        }
                    }
                }
            }
        }
    }
}
#EndRegion

function RemoveSiteCollAdmin([string]$AdminID, [string]$SiteCollectionURL)
{

    #Get the site collection object
     $site = Get-SPSite $SiteCollectionURL

    if ($site -ne $null)
    {
       Write-host -ForegroundColor Magenta "Site" $siteObject.Url "exists!"


       #Get the Admin to remove from Site collection Administrator Group
       $Account = $site.RootWeb.SiteAdministrators | Where-Object {$_.UserLogin -eq $AdminID}

       #if User account found
       if($Account)
       {
          $Account.IsSiteAdmin = $false
          $Account.Update()
          Write-Host -ForegroundColor Green "$($AdminID) has been removed from Site Collection $($SiteCollectionURL) Administrator Group!"
       }
       else
       {
          Write-Host -ForegroundColor DarkMagenta "$($AdminID) Not found in Site Collection Administrator Group!"
       }
    }
    else
    {
          Write-Host -ForeGroundColor Red "- Make sure you have typed the URl Correctly.Site at this" $SiteCollectionURL "does not exist."
    }

}

#Region function call
#start-transcript -path .\CleanUpAdminsFromSiteCollections_Output.txt
Global_CleanUpAdminsFromSiteCollections $xmlinput
#stop-transcript
#EndRegion