Introduction: Consider a scenario where you want to remove multiple users or groups from SharePoint web applications. Doing it manually consumes time. A PowerShell script is useful here. This articles outlines how to remove users or groups from a SharePoint web app user policy using a PowerShell script.

Functionality: The script discussed in this section does the following:

1. Remove a specific user or group from the web app policy
2. Remove a list of users or groups from the web app policy

Function 1
The following piece of code removes a specific user of a group from the web app policy, this functionality requires an input file (WebapplicationList.txt) that lists the web application details in which the user or group should be removed.
  1. Function RemoveSpecificUser()
  2. {
  3. $UserOrGroup = read-host "Enter the user or group to remove from the user policy (e.g domain\user) "
  4. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  6. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  7. if($Didyouplacethefile -eq 'y')
  8. {
  9. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  10. if($testpath)
  11. {
  12. foreach($webapplication in get-content"$scriptbase\WebapplicationList.txt")
  13. {
  14. $webapp = get-spwebapplication $webapplication -ea silentlycontinue
  15. if($webapp -ne $null)
  16. {
  17. #Not enumerating the policies... Once the policy changes by removing the first user it terminates enumeration at that step, so sending it to an output file
  19. foreach($policy in $webapp.policies)
  20. {
  21. $policy.username | out-file $scriptbase\UserName.txt -append
  22. }
  24. foreach($username in get-content "$scriptbase\UserName.txt")
  25. {
  26. if($username -eq $UserOrGroup)
  27. {
  28. write-host "User policy found" -for magenta
  30. write-host "Removing user policy for the user or group " $userorgroup " from the webapplication " $webapplication -fore yellow
  32. $policy = $webApp.Policies.Remove($userOrGroup)
  33. write-host "User policy for the User or group " $userorgroup " removed from the webapplication " $webapplication -fore green
  35. $webApp.Update()
  36. }
  37. else
  38. {
  39. write-host "No action required for the user or group " $username " on the web app " $webapplication -fore cyan
  40. }
  41. }
  42. #removing the output file for next web app in the list
  43. remove-item $scriptbase\UserName.txt -confirm:$false
  44. write-host ""
  45. write-host ""
  47. }
  48. else
  49. {
  50. write-host ""
  51. write-host "Invalid webapplication ...." $webapplication " please check the URL ...." -fore red
  52. write-host ""
  53. }
  54. }
  55. }
  56. else
  57. {
  58. write-host ""
  59. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  60. write-host ""
  61. }
  62. }
  63. else
  64. {
  65. write-host ""
  66. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  67. write-host ""
  68. }
  70. }

Function 2
The following piece of code removes multiple users or groups from a web app policy. This functionality requires 2 input files (WebapplicationList.txt and UserList.txt).

• WebapplicationList.txt: to hold the list of web applications in which the users or groups are to be removed
• UserList.txt: to hold the list of users or groups that needs to be removed from the web applications
  1. Function RemoveListOfUsers()
  2. {
  4. write-host "Place the UserList.txt file under the folder where the script exists" -fore Magenta
  5. $Didyouplacethefile = read-host "Did you place the UserList.txt file under the folder where the script exists (y/n)?"
  6. if($Didyouplacethefile -eq 'y')
  7. {
  8. $TestPath = Test-path -path $scriptbase\UserList.txt
  9. if($TestPath)
  10. {
  11. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  13. $Didyouplacethefile1 = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  14. if($Didyouplacethefile1 -eq 'y')
  15. {
  16. $TestPath1 = Test-path -path $scriptbase\WebapplicationList.txt
  17. if($TestPath1)
  18. {
  19. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  20. {
  21. $webapp = get-spwebapplication $webapplication -ea silentlycontinue
  22. if($webapp -ne $null)
  23. {
  24. foreach($user in get-content $scriptbase\UserList.txt)
  25. {
  26. #Not enumerating the policies... Once the policy changes by removing the first user it terminates enumeration at that step, so sending it to an output file
  28. foreach($policy in $webapp.policies)
  29. {
  30. $policy.username | out-file $scriptbase\UserName.txt -append
  31. }
  33. foreach($username in get-content "$scriptbase\UserName.txt")
  34. {
  35. if($username -eq $user)
  36. {
  37. write-host "User policy found" -fore magenta
  38. write-host "Removing user policy for the user or group " $user " from the webapplication " $webapplication -fore yellow
  39. $policy = $webApp.Policies.Remove($user)
  40. write-host "User policy for the User or group " $user " removed from the webapplication " $webapplication -fore green
  41. $webApp.Update()
  42. }
  43. }
  44. #removing the output file for next web app in the list
  45. remove-item $scriptbase\UserName.txt -confirm:$false
  46. write-host ""
  47. write-host ""
  48. }
  49. }
  50. else
  51. {
  52. write-host ""
  53. write-host "Invalid webapplication ...." $webapplication " please check the URL ...." -fore red
  54. write-host ""
  55. }
  56. }
  57. }
  58. else
  59. {
  60. write-host ""
  61. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  62. write-host ""
  63. }
  65. }
  66. else
  67. {
  68. write-host ""
  69. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  70. write-host ""
  71. }
  72. }
  73. else
  74. {
  75. write-host ""
  76. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  77. write-host ""
  78. }
  79. }
  80. else
  81. {
  82. write-host ""
  83. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  84. write-host ""
  85. }
  87. }
  88. Complete Code:
  89. $LogTime = Get-Date -Format yyyy-MM-dd_hh-mm
  90. $LogFile = ".\RemoveUserOrGroupFromWebAppPolicyPatch-$LogTime.rtf"
  92. # Add SharePoint PowerShell Snapin
  95. if ( (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue) -eq $null )
  96. {
  97. Add-PSSnapin Microsoft.SharePoint.Powershell
  98. }
  100. $scriptBase = split-path $SCRIPT:MyInvocation.MyCommand.Path -parent
  101. Set-Location $scriptBase
  103. write-host "TESTING FOR LOG FOLDER EXISTENCE" -fore yellow
  104. $TestLogFolder = test-path -path $scriptbase\Logs
  105. if($TestLogFolder)
  106. {
  107. write-host "The log folder already exist in the script location" -fore yellow
  108. $clearlogfolder = read-host "Do you want to clear the log folder (y/n)"
  110. if($clearlogfolder -eq 'y')
  111. {
  112. write-host "The user choosen to clear the log folder" -fore yellow
  113. write-host "Clearing the log folder" -fore yellow
  114. remove-item $scriptbase\Logs\* -recurse -confirm:$false
  115. write-host "Log folder cleared" -fore yellow
  116. }
  117. else
  118. {
  119. write-host "The user choosen not to clear the log files" -fore yellow
  120. }
  122. }
  123. else
  124. {
  125. write-host "Log folder does not exist" -fore yellow
  126. write-host "Creating a log folder" -fore yellow
  127. New-Item $Scriptbase\Logs -type directory
  128. write-host "Log folder created" -fore yellow
  129. }
  131. #moving any .rtf files in the scriptbase location
  132. $FindRTFFile = Get-ChildItem $scriptBase\*.* -include *.rtf
  134. if($FindRTFFile)
  135. {
  136. write-host "Some old log files are found in the script location" -fore yellow
  137. write-host "Moving old log files into the Logs folder" -fore yellow
  139. foreach($file in $FindRTFFile)
  140. {
  141. move-item -path $file -destination $scriptbase\logs
  142. }
  143. write-host "Old log files moved successfully" -fore yellow
  144. }
  146. start-transcript $logfile
  149. Function RemoveSpecificUser()
  150. {
  152. $UserOrGroup = read-host "Enter the user or group to remove from the user policy (e.g domain\user) "
  153. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  154. $Didyouplacethefile = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  156. if($Didyouplacethefile -eq 'y')
  157. {
  158. $testpath = Test-path -path $scriptbase\WebapplicationList.txt
  159. if($testpath)
  160. {
  161. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  162. {
  163. $webapp = get-spwebapplication $webapplication -ea silentlycontinue
  164. if($webapp -ne $null)
  165. {
  166. #Not enumerating the policies... Once the policy changes by removing the first user it terminates enumeration at that step, so sending it to an output file
  168. foreach($policy in $webapp.policies)
  169. {
  170. $policy.username | out-file $scriptbase\UserName.txt -append
  171. }
  173. foreach($username in get-content "$scriptbase\UserName.txt")
  174. {
  175. if($username -eq $UserOrGroup)
  176. {
  177. write-host "User policy found" -for magenta
  178. write-host "Removing user policy for the user or group " $userorgroup " from the webapplication " $webapplication -fore yellow
  179. $policy = $webApp.Policies.Remove($userOrGroup)
  180. write-host "User policy for the User or group " $userorgroup " removed from the webapplication " $webapplication -fore green
  181. $webApp.Update()
  182. }
  184. else
  185. {
  186. write-host "No action required for the user or group " $username " on the web app " $webapplication -fore cyan
  187. }
  188. }
  189. #removing the output file for next web app in the list
  190. remove-item $scriptbase\UserName.txt -confirm:$false
  191. write-host ""
  192. write-host ""
  194. }
  195. else
  196. {
  197. write-host ""
  198. write-host "Invalid webapplication ...." $webapplication " please check the URL ...." -fore red
  199. write-host ""
  200. }
  201. }
  202. }
  203. else
  204. {
  205. write-host ""
  206. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  207. write-host ""
  208. }
  209. }
  210. else
  211. {
  212. write-host ""
  213. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  214. write-host ""
  215. }
  217. }
  220. Function RemoveListOfUsers()
  221. {
  223. write-host "Place the UserList.txt file under the folder where the script exists" -fore Magenta
  224. $Didyouplacethefile = read-host "Did you place the UserList.txt file under the folder where the script exists (y/n)?"
  225. if($Didyouplacethefile -eq 'y')
  226. {
  227. $TestPath = Test-path -path $scriptbase\UserList.txt
  228. if($TestPath)
  229. {
  231. write-host "Place the WebapplicationList.txt file under the folder where the script exists" -fore Magenta
  232. $Didyouplacethefile1 = read-host "Did you place the WebapplicationList.txt file under the folder where the script exists (y/n)?"
  233. if($Didyouplacethefile1 -eq 'y')
  234. {
  235. $TestPath1 = Test-path -path $scriptbase\WebapplicationList.txt
  237. if($TestPath1)
  238. {
  240. foreach($webapplication in get-content "$scriptbase\WebapplicationList.txt")
  241. {
  242. $webapp = get-spwebapplication $webapplication -ea silentlycontinue
  244. if($webapp -ne $null)
  245. {
  247. foreach($user in get-content $scriptbase\UserList.txt)
  248. {
  250. #Not enumerating the policies... Once the policy changes by removing the first user it terminates enumeration at that step, so sending it to an output file
  251. foreach($policy in $webapp.policies)
  252. {
  253. $policy.username | out-file $scriptbase\UserName.txt -append
  254. }
  256. foreach($username in get-content "$scriptbase\UserName.txt")
  257. {
  259. if($username -eq $user)
  260. {
  261. write-host "User policy found" -fore magenta
  262. write-host "Removing user policy for the user or group " $user " from the webapplication " $webapplication -fore yellow
  264. $policy = $webApp.Policies.Remove($user)
  265. write-host "User policy for the User or group " $user " removed from the webapplication " $webapplication -fore green
  266. $webApp.Update()
  267. }
  268. }
  270. #removing the output file for next web app in the list
  271. remove-item $scriptbase\UserName.txt -confirm:$false
  272. write-host ""
  273. write-host ""
  274. }
  275. }
  276. else
  277. {
  278. write-host ""
  279. write-host "Invalid webapplication ...." $webapplication " please check the URL ...." -fore red
  280. write-host ""
  281. }
  282. }
  283. }
  284. else
  285. {
  286. write-host ""
  287. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  288. write-host ""
  289. }
  291. }
  292. else
  293. {
  294. write-host ""
  295. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  296. write-host ""
  297. }
  298. }
  299. else
  300. {
  301. write-host ""
  302. write-host "The file is not placed or its incorrectly spelled" -fore cyan
  303. write-host ""
  304. }
  305. }
  306. else
  307. {
  308. write-host ""
  309. write-host "The user choose to exit.... Please try again after placing the file" -fore cyan
  310. write-host ""
  311. }
  313. }
  315. write-host "########################################################################################################" -fore cyan
  316. write-host "Enter 1 to remove specific user from user policy" -fore green
  317. write-host "Enter 2 to remove list of users from user policy" -fore green
  318. write-host "########################################################################################################" -fore cyan
  320. $option = read-host "Enter the option "
  322. switch($option)
  324. {
  326. 1{
  328. RemoveSpecificUser
  330. }
  332. 2{
  334. RemoveListOfUsers
  336. }
  339. }
  340. write-host "SCRIPT COMPLETED" -fore Blue
  341. stop-transcript
Execution Procedure

Step 1: Download and copy the script to the SharePoint server.
Step 2: Launch the SharePoint management shell.
Step 3: Navigate to the script path and execute the following script:
Enter option “1” or “2” to get the desired output.

Conclusion

Thus this article outlined how to remove users or groups from a SharePoint web app policy using a PowerShell script.