$OneDriveLocationLength =  $Env:OneDrive.Length
$LengthToCheck = 249 - $OneDriveLocationLength
$SyncFile = "\\NetworkShare\OneDriveSyncissues\" + $Env:USERNAME + "-" + $Env:COMPUTERNAME + ".csv" #Replace with Network Share
$Columns = "Name" + ";" + "Type" + ";" + "IsFolderLengthLong" + ";" + "IsFileLengthLong" + ";" + "IsFolderFileLengthLong" + ";" + "Length"
$columns | out-file -filepath $SyncFile -append
$PathExclusion = @("Windows";"Program Files") # Add/Remove folders that you will like to exclude from Scan
$Drives = @("C:\" ; "D:\") #Add/Remove Drives from Scran
$FoldersToCheck = @()
foreach($Drive in $Drives)

{

    $Folders = Get-ChildItem  $Drive | Where-Object {($_.PSIscontainer -eq $true) }
    foreach ($Folder in $Folders)
            {
                    $i=0
                    $Exclude = 0
                    $Count = $PathExclusion.Count
                   
                        while($i -le $Count)
                             {
            
                                if($Folder.name -eq $PathExclusion[$i])
                                    {
                                    $Exclude = 1
                                    }
               
                                else
                                    {
                               
                                    }
                                    $i++
            
                            }
                                 if ($Exclude -eq 1)
                                 {
                                
                                 }
                                 else
                                 {
                                 $FoldersToCheck += $folder.FullName
                                 }

               }
              
              
}

function FileLength ($FileLengthDir)
{

$FilesForLength = @()
$FilesForLength  = Get-ChildItem  $FolderToCheck -Recurse -ErrorAction silentlycontinue | Where-Object {($_.PSIscontainer -eq $false) }

    foreach($FileForLength in $FilesForLength)
    {
        if($FileForLength -eq $null)
        {
        }
        else
        {
   
            if($FileForLength.name.length -ge $LengthToCheck)
            {
                   
            $Output = $FileForLength.Fullname + ";" + "File" + ";" + "" + ";" + "Yes" + ";" + "" + ";" + $FileForLength.name.length
            $Output | out-file -filepath $SyncFile -append
           
            }
           
            if($FileForLength.Fullname.length -ge $LengthToCheck)
            {
           
            $Output = $FileForLength.Fullname + ";" + "FolderFile" + ";" + "" + ";" + "" + ";" + "Yes" + ";" + $FileForLength.Fullname.length
            $Output | out-file -filepath $SyncFile -append
            }
           
        }   
   }

}

function FolderLength ($FolderToCheck)
{
$FoldersForLength = @()
$FoldersForLength  += Get-Item  $FolderToCheck -ErrorAction silentlycontinue | Where-Object {($_.PSIscontainer -eq $true) }
$FoldersForLength  += Get-ChildItem  $FolderToCheck -Recurse -ErrorAction silentlycontinue | Where-Object {($_.PSIscontainer -eq $true) }

    foreach($FolderForLength in $FoldersForLength)
    {
        if($FolderForLength.fullname.length -ge $LengthToCheck)
        {
       
        $Output = $FolderForLength.fullname + ";" + "Folder" + ";" + "Yes" + ";" + "" + ";" + "" + ";" + $FolderForLength.fullname.length
        $Output | out-file -filepath $SyncFile -append  
        }
        if ($FolderForLength -eq $null)
        {
        }
        else
        {
        FileLength ($FolderForLength.fullname)
        }
       
    }

}

foreach ($FolderToCheck in $FoldersToCheck)
{
FolderLength $FolderToCheck

}

Following Script can be set as a Scheduled task on End User Computers. This script will check for Invalid File Names inside OneDrive([!&{}~#%]) and Rename them. It also stores the Mapping file containing Old name and new name in End User OneDrive(OneDrive Mapping File.csv). Mapping file is appended and not recreated.

$OneDriveLocation =  $Env:OneDrive
$SyncFile = $OneDriveLocation + "\OneDrive Mapping File.csv"

function CheckSyncFile()
{
    $GetSyncFile = Get-ChildItem $SyncFile -ErrorAction silentlycontinue
    if($GetSyncFile -eq $null)
    {
    $Columns = "Orignal File Name " + ";" + "Updated File Name" + ";" + "Date"
    $columns | out-file -filepath $SyncFile -append
    }
    else
    {
    }

}

function RenameFile($RenameFileTo)
{
$OrignalFile = $Item.FullName
Rename-Item $item.FullName -NewName ($RenameFileTo)
$ChangeTime = Get-Date -Format "MM-dd-yyyy_hh-mm-ss"

$output = $OrignalFile + ";" + $item.Directory.FullName.ToString() + "\" + $RenameFileTo + "," + $ChangeTime
$output | out-file -filepath $SyncFile -append

}

function FindDuplicate ($NewFileName)

{

$TestFile = $item.Directory.FullName + "\" + $newFileName
$CheckDup = Get-ChildItem $TestFile -ErrorAction silentlycontinue
    if($CheckDup -eq $null)
    {
    $RenameFileTo = $NewFileName
    }
    else
    {
    $logTime = Get-Date -displayhint time
    $logTime = $logTime.Minute.ToString()  + $logTime.Second.ToString()
    $SplitExtension = $NewFileName.Split(".")
    $FileName = $SplitExtension[0].ToString() + $logTime
    $RenameFileTo = ($NewFileName -replace $SplitExtension[0], $FileName)
    }
   
    RenameFile $RenameFileTo

}

function CheckFileNames ($item)
{

        if($Item.Name -match $UnsupportedChars)
        {
            $newFileName = $item.Name
            if ($Item.Name -match "&") { $NewFileName = ($NewFileName -replace "&", "and") }
            if ($Item.Name -match "{") { $NewFileName = ($NewFileName -replace "{", "(") }
            if ($Item.Name -match "}") { $NewFileName = ($NewFileName -replace "}", ")") }
            if ($Item.Name -match "~") { $NewFileName = ($NewFileName -replace "~", "-") }
            if ($Item.Name -match "#") { $NewFileName = ($NewFileName -replace "#", "-") }
            if ($Item.Name -match "%") { $NewFileName = ($NewFileName -replace "%", "-") }
            if ($Item.Name -match "!") { $NewFileName = ($NewFileName -replace "!", "-") }
  
               if ($NewFileName -ne $item.Name)
                    {
                        FindDuplicate $NewFileName
                    }
              
        }
       

}

CheckSyncFile

$Items = Get-ChildItem $OneDriveLocation -Recurse -Exclude "OneDrive Mapping File.csv"
$UnsupportedChars = '[!&{}~#%]'

    foreach ($item in $items)
    {
 
    CheckFileNames $item
        
    }
     

Credit https://gallery.technet.microsoft.com/office/Check-for-unsupported-6676929a

Recently I had couple of customers asking me for a script where they can replace Everyone/Everyone except external users account in SPO with a different account/group.

Following script will copy permissions of an account to a new account.

1. It will check for SharePoint Group membership
2. It will check for SPWeb unique membership
3. It will check for SPList unique membership
4. It will check for SPFolder unique membership
5. It will check for SPItem unique membership

After this script you can remove or even disable Everyone from showing in people picker.

Let me know your suggestions in comments. I will try to add your suggestions to my script.

[System.Reflection.Assembly]::LoadFile("C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.SharePoint.Client.dll") | Out-Null

[System.Reflection.Assembly]::LoadFile("C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.SharePoint.Client.Runtime.dll") | Out-Null

$username = "admin@MOD841120.onmicrosoft.com" #Replace this with SPO Admin

$password = "password" #Replace this with SPO Admin password

$password = ConvertTo-SecureString $password -AsPlainText -Force

$spoCred = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($UserName, $Password)

$url = "https://mod841120.sharepoint.com/sites/DemoPerm" #URL of the SPO Site Collection

$FindUser = "c:0-.f|rolemanager|spo-grid-all-users/c1051fd0-af79-4b55-8710-a34798fbe37b" #User Id for External Users

$New = "industrytrends@MOD841120.onmicrosoft.com" #Group/User that you want to add

#No changes required from this point

$global:AllWebs = @()

Function Invoke-LoadMethod() {

param(

   [Microsoft.SharePoint.Client.ClientObject]$Object = $(throw "Please provide a Client Object"),

   [string]$PropertyName

)

   $ctx = $Object.Context

   $load = [Microsoft.SharePoint.Client.ClientContext].GetMethod("Load")

   $type = $Object.GetType()

   $clientLoad = $load.MakeGenericMethod($type)

   $Parameter = [System.Linq.Expressions.Expression]::Parameter(($type), $type.Name)

   $Expression = [System.Linq.Expressions.Expression]::Lambda(

            [System.Linq.Expressions.Expression]::Convert(

                [System.Linq.Expressions.Expression]::PropertyOrField($Parameter,$PropertyName),

                [System.Object]

            ),

            $($Parameter)

   )

   $ExpressionArray = [System.Array]::CreateInstance($Expression.GetType(), 1)

   $ExpressionArray.SetValue($Expression, 0)

   $clientLoad.Invoke($ctx,@($Object,$ExpressionArray))

}

function CheckGroup($SPOWeb , $UserID)

{

    $User = $SPOWeb.EnsureUser($New)

    $Context.Load($User)

    $Context.ExecuteQuery()

    $Groups = $SPOWeb.SiteGroups

    $context.Load($Groups)

    $context.ExecuteQuery()

    foreach($Group in $Groups)

        {

        $context.Load($Group)

        $context.ExecuteQuery()

        $GroupUser = $Group.Users.GetById($UserID)

        $context.Load($GroupUser)

            try

            {

            $context.ExecuteQuery()

            $Context.Load($Group)

            $Context.Load($Group.Users.AddUser($User))

            $Context.ExecuteQuery()

            }

            Catch

            {

            }

        }

}

function Get-SPOWebs(){

param(

   $Url = $(throw "Please provide a Site Collection Url"),

   $Credential = $(throw "Please provide a Credentials")

)

  $context = New-Object Microsoft.SharePoint.Client.ClientContext($Url) 

  $context.Credentials = $spoCred

  $web = $context.Web

  $context.Load($web)

  $context.ExecuteQuery()

  $User = $web.SiteUsers.GetByLoginName($FindUser)

      $context.Load($User)

      try

      {

      $context.ExecuteQuery()

      CheckGroup $Web $User.ID

  $context.Load($web.webs)

  $context.ExecuteQuery()

  foreach($web in $web.Webs)

  {

       Get-SPOWebs -Url $web.Url -Credential $Credential

       $global:AllWebs += $web.url

  }

      }

      Catch

      {

      }

}

$global:AllWebs += $url

Get-SPOWebs -Url $Url -Credential $spoCred

function ReplaceUserInWeb($SPOW , $SPOWBinding)

{

$User = $SPOW.EnsureUser($New)

$Context.Load($User)

$Context.ExecuteQuery()

$Perm = $SPOw.RoleDefinitions.GetByName($SPOWBinding)

$Context.Load($Perm)

$Context.ExecuteQuery()

$Roleassignment = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($Context)

$Roleassignment.Add($Perm)

$Context.Load($SPOW.RoleAssignments.Add($User,$Roleassignment))

$SPOW.update()

$Context.ExecuteQuery()

}

function ReplaceUserInList($SPOW , $SPOLBinding , $SPOListID)

{

$User = $SPOW.EnsureUser($New)

$Context.Load($User)

$Context.ExecuteQuery()

$List = $SPOW.Lists.GetById($SPOListID)

$context.Load($List)

$context.ExecuteQuery()

$Perm = $SPOw.RoleDefinitions.GetByName($SPOLBinding)

$Context.Load($Perm)

$Context.ExecuteQuery()

$Roleassignment = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($Context)

$Roleassignment.Add($Perm)

$Context.Load($List.RoleAssignments.Add($User,$Roleassignment))

$List.update()

$Context.ExecuteQuery()

}

function ReplaceUserInListItem($SPOW , $SPOLBinding, $ListID,$ItemID)

{

$User = $SPOW.EnsureUser($New)

$Context.Load($User)

$Context.ExecuteQuery()

$List = $SPOW.Lists.GetById($ListID)

$context.Load($List)

$context.ExecuteQuery()

$ListItem = $List.GetItemById($ItemID)

$context.Load($ListItem)

$context.ExecuteQuery()

$Perm = $SPOw.RoleDefinitions.GetByName($SPOLBinding)

$Context.Load($Perm)

$Context.ExecuteQuery()

$Roleassignment = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($Context)

$Roleassignment.Add($Perm)

$Context.Load($ListItem.RoleAssignments.Add($User,$Roleassignment))

$ListItem.update()

$Context.ExecuteQuery()

}

function GetListItemsRoleBinding($SPOW , $UserID , $ListID,$ItemID)

{

$LIBindings = @()

$List = $SPOW.Lists.GetById($ListID)

$context.Load($List)

$context.ExecuteQuery()

$ListItem = $List.GetItemById($ItemID)

$context.Load($ListItem)

$context.ExecuteQuery()

$SPOLIRole = $ListItem.RoleAssignments.GetByPrincipalId($UserID)

$context.Load($SPOLIRole)

$context.ExecuteQuery()

$LIRoleBindings = $SPOLIRole.RoleDefinitionBindings

$context.Load($LIRoleBindings)

$context.ExecuteQuery()

    foreach($LIRoleBinding in $LIRoleBindings)

    {

    $context.load($LIRoleBinding)

    $context.ExecuteQuery()

          if($LIRoleBinding.Name -eq "Limited Access")

        {

        }

        else

        {

        $LIBindings += $LIRoleBinding.Name

        }

    }

    return $LIBindings

}

function GetListRoleBinding($SPOW , $UserID , $ListID)

{

$LBindings = @()

$List = $SPOW.Lists.GetById($ListID)

$context.Load($List)

$context.ExecuteQuery()

$SPOLRole = $List.RoleAssignments.GetByPrincipalId($UserID)

$context.Load($SPOLRole)

$context.ExecuteQuery()

$LRoleBindings = $SPOLRole.RoleDefinitionBindings

$context.Load($LRoleBindings)

$context.ExecuteQuery()

    foreach($LRoleBinding in $LRoleBindings)

    {

    $context.load($LRoleBinding)

    $context.ExecuteQuery()

          if($LRoleBinding.Name -eq "Limited Access")

        {

        }

        else

        {

        $LBindings += $LRoleBinding.Name

        }

    }

    $LBindings.count

    return $LBindings

}

function GetWebRoleBinding($SPOW , $UserID )

{

$Bindings = @()

$SPOWRole = $SPOW.RoleAssignments.GetByPrincipalId($UserID)

$context.Load($SPOWRole)

$context.ExecuteQuery()

$RoleBindings = $SPOWRole.RoleDefinitionBindings

$context.Load($RoleBindings)

$context.ExecuteQuery()

    foreach($RoleBinding in $RoleBindings)

    {

    $context.load($RoleBinding)

    $context.ExecuteQuery()

          if($RoleBinding.Name -eq "Limited Access")

        {

        }

        else

        {

        $Bindings += $RoleBinding.Name

        }

    }

    return $Bindings

}

foreach($Web in $AllWebs)

{

$context = New-Object Microsoft.SharePoint.Client.ClientContext($web) 

$context.Credentials = $spoCred

$SPOWeb = $context.Web

$context.Load($SPOWeb)

$context.ExecuteQuery()

Invoke-LoadMethod -Object $SPOWeb -PropertyName "HasUniqueRoleAssignments"

$context.ExecuteQuery()

$SPOWebUser = $spoweb.SiteUsers.GetByLoginName($FindUser)

$context.Load($SPOWebUser)

try{

$context.ExecuteQuery()

}

catch

{

write-host "User does not Exist in the site collection"

}

    if ($SPOWeb.HasUniqueRoleAssignments -eq $true)

               {

                $SPOWebRoles = $SPOWeb.RoleAssignments.GetByPrincipalId($SPOWebUser.Id)

                $context.Load($SPOWebROles)

                      try{

                        $context.ExecuteQuery()

                        $GetWBindings = GetWebRoleBinding $SPOWeb $SPOWebUser.Id

                        foreach ($GetWBinding in $GetWBindings)

                                 {

                                   $ReplaceUser = ReplaceUserInWeb $SPOWeb $GetWBinding

                                 }

                        }

                        catch

                        {

                        }

               }

     else

               {

               }

    $Lists = $spoWeb.Lists

    $Context.Load($Lists)

    $context.ExecuteQuery()

    foreach($List in $Lists)

    {

       $Context.Load($List)

       Invoke-LoadMethod -Object $List -PropertyName "HasUniqueRoleAssignments"

       $context.ExecuteQuery()

       if (($List.HasUniqueRoleAssignments -eq $true) -and ($List.Hidden -eq $false)  )

           {

            $ListRoles = $List.RoleAssignments.GetByPrincipalId($SPOWebUser.Id)

            $context.Load($ListROles)

                try

                {

                $context.ExecuteQuery()

                $GetLBindings = $null

                $GetLBindings = GetListRoleBinding $SPOWeb $SPOWebUser.Id $List.id

                    foreach ($GetLBinding in $GetLBindings)

                            {

                            $Type = $GetLBinding.GetType()

                                if($Type.Name -eq "String")

                                {

                                $ReplaceLUser = ReplaceUserInList $SPOWeb $GetLBinding $List.ID

                                }

                            }

                }

                catch

                {

                }

           }

           else

           {

           }

           $qry = [Microsoft.SharePoint.Client.CamlQuery]::CreateAllItemsQuery()

           $ListItems = $List.GetItems($qry)

           $context.Load($ListItems)

           $Context.ExecuteQuery()

            foreach($ListItem in $ListItems)

            {

                $Context.Load($ListItem)

                Invoke-LoadMethod -Object $ListItem -PropertyName "HasUniqueRoleAssignments"

                $context.ExecuteQuery()

                if ($ListItem.HasUniqueRoleAssignments -eq $true)

                    {

                        $ListItemRoles = $ListItem.RoleAssignments.GetByPrincipalId($SPOWebUser.Id)

                        $context.Load($ListItemRoles)

                            try

                            {

                            $context.ExecuteQuery()

                            $GetLIBindings = $null

                            $GetLIBindings = GetListItemsRoleBinding $SPOWeb $SPOWebUser.Id $List.id $ListItem.ID

                                foreach ($GetLIBinding in $GetLIBindings)

                                        {

                                        $Type = $GetLIBinding.GetType()

                                            if($Type.Name -eq "String")

                                            {

                                            $ReplaceLUser = ReplaceUserInListItem $SPOWeb $GetLIBinding $List.ID $ListItem.ID

                                            }

                                        }

                            }

                            catch

                            {

                            }

                    }

            }

    }

}

$context.Dispose()

There will be several instances when you will like to generate reports of all the unique permissions that are present through out the site collection.

I have written a script which will generate a CSV report with all the users and groups added on the Web, List, Item or Folder level

Refer to the screenshot CSV report.

This report

will contain 7 columns

1. WebURL – Url of the Site
2. List Default View URL – Default view of the List. If this is blank that means permission are broken at Web Level and the User-Group reported has been added at the web level. If this contains information then it means permissions have been broken at the list level and the user-group along with permission reported has been added at the List level.
3. List Title – Title of the list. If this is blank that means permission are broken at Web Level and the User-Group reported has been added at the web level.If this contains information then it means permissions have been broken at the list level and the user-group along with permission reported has been added at the List level.
4. Item URL – URL of the Item.If this is blank that means permission are broken at Web/list Level and the User-Group reported has been added at the web/list level. If this contains information then it means permissions have been broken at the Item level and the user-group along with permission reported has been added at the Item level.
5. Name – Name of User or Group
6. Type – If it’s a Domain Group, Domain User or SharePoint Group
7. Permission – Permissions granted to the user or group. Note if the OOB permissions levels have been modified then this information might mislead. It’s not a good practice to modify OOB permission levels.

 

---

Add-PSSnapin Microsoft.SharePoint.Powershell
$Url = "https://contoso.com" #Replace URL with your site collection
$RootURL = $url.Split("/") # Split function is required for Host based site collection
$RootURL = $RootURL[0] + "/" + $RootURL[1] + "/" + $RootURL[2]

$logTime = Get-Date -Format "Mm-dd-yyyy_hh-mm-ss"
$Columns = "WebURL" + ";" + "List Default View URL" + ";" + "List Title" + ";" + "Item URL" + ";" + "Name" + ";" + "Type" +";"+"Permission"
$logFile = "C:\UniquePermissions" + $logtime + ".csv" # Log Location
$columns | out-file -filepath $logfile -append

$site=Get-SPSite $url

$Webs = $site.AllWebs
foreach($web in $webs)
{

    if($web.HasUniqueRoleAssignments)

      {
        $WebRoles = $Web.RoleAssignments
        foreach($WebRole in $WebRoles)
            {

            $WebRoleBindings = $WebRole.RoleDefinitionBindings
            foreach($WebRoleBinding in $WebRoleBindings)
               {

                if($webrole.Member.IsDomainGroup -eq $null)
                    {
                    $output = $web.url + ";" + ";" + ";" +  ";" + $WebRole.member.Name + ";" + "SharePoint Group" + ";" + $WebRoleBinding.Name
                    $output | out-file -filepath $logfile -append
                    }
                    else
                    {
                        if($webrole.Member.IsDomainGroup)
                        {
                        $output = $web.url + ";" + ";" + ";" +  ";" + $WebRole.member.Name + ";" + "Domain Group" + ";" + $WebRoleBinding.Name
                        $output | out-file -filepath $logfile -append
                        }
                        else
                       
                        {
                        $output = $web.url + ";" + ";" + ";" +  ";" + $WebRole.member.UserLogin + ";" + "Domain User" + ";" + $WebRoleBinding.Name
                        $output | out-file -filepath $logfile -append
                        }
                    }
                }

            }
       
      }
   
    $lists = $web.Lists
    foreach($list in $lists)
    {
        if($list.HasUniqueRoleAssignments)
        {

            $ListRoles = $list.RoleAssignments
            foreach($listRole in $ListRoles)
                {
           
                    $ListRoleBindings = $listrole.RoleDefinitionBindings
                    foreach($ListRoleBinding in $ListRoleBindings)
                    {
               

                if($listrole.Member.IsDomainGroup -eq $null)
                    {
                    $output = $web.url + ";" + $rooturl + $list.DefaultViewUrl + ";" + $list.Title +  ";" + ";" + $ListRole.Member.Name + ";" + "SharePoint Group" + ";" + $ListRoleBinding.Name
                        $output | out-file -filepath $logfile -append       
                    }
                    else
                    {
                        if($listrole.Member.IsDomainGroup)
                        {
                        $output = $web.url + ";" + $rooturl + $list.DefaultViewUrl + ";" + $list.Title +  ";" + ";" + $ListRole.Member.Name + ";" + "Domain Group" + ";" + $ListRoleBinding.Name
                        $output | out-file -filepath $logfile -append       
                        }
                        else
                       
                        {
                       
                        $output = $web.url + ";" + $rooturl + $list.DefaultViewUrl + ";" + $list.Title +  ";" + ";" + $ListRole.Member.UserLogin + ";" + "Domain User" + ";" + $ListRoleBinding.Name
                        $output | out-file -filepath $logfile -append       

                        }
                    }

  
                    }
           
                }

        }

      

        $Uniqueitems = $list.GetItemsWithUniquePermissions()
            foreach($Uniqueitem in $Uniqueitems)
            {

                $item = $list.GetItemById($Uniqueitem.id)
                $itemRoles = $item.RoleAssignments
                foreach($itemRole in $itemroles)
                    {
                    $itemRoleBindings = $itemrole.RoleDefinitionBindings
                    foreach($itemrolebinding in $itemRoleBindings)
                        {
                       

                        if($itemrole.Member.IsDomainGroup -eq $null)
                    {
                   
                    $output = $web.url + ";" + $rooturl + $list.DefaultViewUrl + ";" + $list.Title +  ";" + $rooturl+ "/" +$item.Url + ";" + $itemRole.Member.Name + ";" + "SharePoint Group" + ";" + $itemRoleBinding.Name
                        $output | out-file -filepath $logfile -append
                   
                   
                    }
                    else
                    {
                        if($itemrole.Member.IsDomainGroup)
                        {
                       
                    $output = $web.url + ";" + $rooturl + $list.DefaultViewUrl + ";" + $list.Title +  ";" + $rooturl+ "/" +$item.Url + ";" + $itemRole.Member.Name + ";" + "Domain Group" + ";" + $itemRoleBinding.Name
                        $output | out-file -filepath $logfile -append

                        }
                        else
                       
                        {
                        $output = $web.url + ";" + $rooturl + $list.DefaultViewUrl + ";" + $list.Title +  ";" + $rooturl+ "/" +$item.Url + ";" + $itemRole.Member.UserLogin + ";" + "Domain User" + ";" + $itemRoleBinding.Name
                        $output | out-file -filepath $logfile -append
                        }
                    }

     }
                    }

            }

    }

    $web.Dispose()

}

$site.Dispose()

---

This will not work for SharePoint 2007, I have written one for SharePoint 2007 too, if someone needs it then leave a comment and I will share it out.

Lack of information prompted me to write this blog. SharePoint at an enterprise level is being deployed to serve various needs. There are times when you want to utilize SharePoint to store confidential information , this is when you think of security.

There are few things that we can control and few things which we can't . For example I can give user a read permission and disable copy/paste but I can't stop user from memorizing the content, writing content on a piece of a paper or from taking a picture of his Monitor.

In this blog, I am going to talk about the things we can control.

1. Infrastructure - A solid infrastructure gets half the job done. Take  a look at couple of Extranet designs

https://technet.microsoft.com/en-us/library/cc263513(v=office.14).aspx

2. Secure Login - The very first thing you want to implement is Secure Login. By default SharePoint is going to prompt for credentials if you are logging in to the portal from a computer which is not connected to corpnet. For environments which are going to use information which is going to be conferential in nature, I recommend implementing Two factor Authentication.

Two Factor Authentication ?

This is where user need to provide two pieces of ID to get authenticated. In a normal scenario User will provide  user name and password and that is good enough for user to get access in to the portal. Adding another factor will make this a Two factor authentication. For Example, You can implement RSA in your environment. RSA does make login mechanism quite secure

3. Protection against download copies  - All a user needs is a read access to download data and use it offline. Data downloaded then can't be monitored and can be send to anyone. You can implement IRM in order to protect data in such scenario.

IRM can be applied at the document level and also at a library level, best approach will be to apply IRM policy on the document before uploading it.

Once you have applied IRM to the document, only the user who have access to the document will be able to open the online/offline copy of the document.

OOB SharePoint protects Office documents, you will need to install protectors for other file types

4. Scan the data - It is very important to know where the confidential/sensitive/PPI information is stored. Imagine a situation where some sensitive information is stored in a library which is not monitored aggressively or is not supposed to contain sensitive data .

Unfortunately there is no OOB way of scanning and reporting such content unless you create bunch of scripts to find it.

There are plenty of third party tools which do a good job in scanning the environment for patterns and then generating reports. I would recommend you to look for something which scans in a background and sends you a report as there will be lots of false positive.

This approach will help you in taking necessary actions and make sure data is stored in right places.

5. Abuse of Rights - This is where things gets interesting, how to protect data from the users who have access to it?

Honestly I have not found a way which protects you from this fully, main reason being they have access to edit the file.

Few things that you can do is to disable features such as copy/paste. IRM by default disables copy/paste for users with read access but not for users who have write access. There are third party tools available for doing this job along with scanning the data.

Please note, if you are storing content in excel then disabling copy/paste will be bit hard as that needs to be done through macros.

Another approach could be do develop a custom web part to show information and restrict the actions a user can take.

6. Auditing - You really need a detailed auditing, OOB SharePoint does a good job in auditing but you can always buy a third party product to get more detailed Auditing. Do not ignore Auditing.

I hope you find this information useful when planning a secure environment.

Issue

I recently worked on a case where customer was facing issue when trying to add Apps on Host Header Site collection. He does not face any issues while trying to add apps on site collection created without host header mode.

Repro

Here are the steps to reproduce the issue, these steps can also help you in configuring HH mode site collection in case you were not sure on how to do it :) (These steps will also work on SharePoint 2007)

1. Create a New web application, In my case it is https://sps2013-a.com

2. $Sub = New-SPSiteSubscription (This cmmdlet will help in generating new SPSite Subscription)

3. New-SPSite https://test.walia.com -OwnerAlias walia\administrator -HostHeaderWebApplication https://sps2013-a -language 1033 -sitesubscription $sub

The above command will create a new Site collection in HH mode and assign a unique subscription ID(We generated this ID in Step 2)

4. new-spsite -url https://sps2013-a/sites/tadminsite -template TENANTADMIN#0 -owneralias walia\administrator -AdministrationSiteType tenantadministration -language 1033 -sitesubscription $sub

(The above command will create a new Tenant Administration site and will tie the HH mode site collection to it,We assign it the same Subscription ID of the HH mode site)

5) Browse to the Site https://test1.walia.com

6) Click on Site Contents and try to add App from App Store

You will receive "Sorry, apps are turned off. If you know who runs the server, tell them to enable apps"

Data Analysis

Following message is logged in ULS logs

01/02/2013 15:42:10.29        w3wp.exe (0x0A0C)        0x03E0        SharePoint Foundation        App Deployment        adysh        High        The site subscription name for site https://test.walia.com does not exist. The site subscription name must exist to complete this operation.        19fdf09b-7152-3086-ee69-b85fa6faa86c

Resolution

1) Browse to Tenant Administration Site of the HH mode Site collection

2) Create App Catalog for Tenant by clicking on Manage App Catalog

Note – Every Tenant Admin will require a App Catalog(Make sure Self site creation is enabled in order for App Catalog to get created)

3) $Sub = Get-SPSiteSubscription https://hhmodeSite (This CMDlet will help in fetching the subscription ID of the HH mode site collection)

Set-SPAppSiteSubscriptionName -Name "Name for Subscription" -SiteSubscription $Sub

We need to run the above command in order to set the unique name for domain under which these apps will run.More details can be found under https://technet.microsoft.com/en-us/library/jj219503.aspx

Feel free to post comments if you have any confusion regarding any of the steps.

This blog post is to help you in configure Incoming emails in SharePoint 2013 using Exchange Server 2013

Setup

Domain Controller – Windows Server 2012

Exchange Server – Exchange Server 2013

SharePoint Server – SharePoint Server 2013

Lets begin the process of setting up Incoming emails

Creating OU for Storing Email Alias

• Log in to DC or any computer which have Active Directory administration tools installed.

• Open "Active Directory users and Computers"

• Right click on domain name and select New > Organizational Unit

• Provide some meaningful name and click on OK

• Make sure the account which is running Timer Service on SharePoint Server has permissions to create and delete objects.

Add SMTP role to the SharePoint Server

• Browse to Server Manager and click on Manage > Add roles and features

• Click on Next and choose "Select a server from the server pool" and click Next

• Click Next on the Roles screen

• Select SMTP

• Click on Add Features

• Click Next

• Click Install

Create Send Connector

• Browse to Exchange console https://ExchangeServerName/ecp, in my case it will be https://exch/ecp

• Click on Mail Flow > Send Connectors

• Click on New Send Connector Icon and give it meaningful name and chose Internal

• Choose "Route mail through smart hosts" and click on Add and provide SharePoint Server FQDN

• Choose None as the Authentication method

• Provide the FQDN of the SharePoint Server where SMTP role is installed and click on Save and then Next

• On the Source Server screen add the exchange server and click on Finish

• Ensure that the Connector status shows as Enabled

Configure SMTP on SharePoint Server

• Browse to Server Manager > Local Server > Tools> "Internet Information Services (IIS) 6.0 Manager"

• Expand Server Name >

• Right Click on SMTP and click on Properties

• Click on Access > Authentication and ensure Anonymous is checked

Configure Email Settings in SharePoint

• Browse to SharePoint central Administration

• Click on System Settings > Configure Incoming e-mail settings

• Configure settings based on the screen shots

Enable Incoming email on Document library

• Browse to your Web Application

• Create a new document library App
• Browse to the List settings of the Document Library App

• Click on Incoming e-mail settings

• Configure the settings based on the following screen shot

• Browse to the OU SharePoint Alias and make sure you see the contact created in it

Test the incoming email functionality

• Send an email with an attachment to the email address that you configured, in my case it was doclib@sps2013.walia.com

• Navigate to the Drop folder on the SMTP server, default location for the drop folder is C:\inetpub\mailroot\Drop

• You should see your emails sent in this folder

• Wait for 5 mins and these emails should get processed by the timer service

• Browse to the Document library and you should see the attachment being uploaded to the document library

Feel free to post comments if you have any confusion regarding any of the steps.

Problem

In this case customer was getting the following error when he was trying to checkout a document

"This document could not be checked out to your local drafts folder. The document may have already been checked out, or the local drafts folder could not be written to."

Interestingly this issue did not occur on a new web application, and we did not see anything strange in ULS logs either.

Solution

This was also an issue caused by the WebDAV module, interestingly customer had this WebDAV module installed for only one web application which kind of explain why the issue was occurring on only one web application

Question - How do I remove WebDAV module from IIS Server?

Answer - This is how you can remove WebDAV module from IIS

1) Open Server Manager

2) Expand Roles, click on Web Server(IIS)

3) Click on Remove Role Services

4) UnCheck WebDAV Publishing

5) Click Next

6) Click Remove

Question - I cannot remove WebDAV module as my non-SharePoint sites use this module

Answer – In that case we can remove WebDAV modules from just SharePoint site instead of removing it from the IIS

1) Open IIS

2) Expand Sites

3) Select the SharePoint Web Application

4) Select Modules from the Features View

5) Select WebDAVModule from the list of Native Modules and click on Remove

Problem

Recently I worked on an issue where one of our customer was getting Access Denied when adding the Operations Manager Web Part, and logs did not give us clear indication as to where exactly we were failing

Please refer to “Using SharePoint to View Operations Manager Data” TechNet article to know how to integrate Operations manager

Symptoms

We received Access Denied when adding the operations manager web part on the site collection and following stack is logged in the ULS logs

[Date and Time] w3wp.exe (0x1B94) 0x1540 Unknown Operations Manager 40 Verbose Error - <PortalWebPart.InitializeWebPartConfiguration> Error: System.Configuration.ConfigurationErrorsException: The Web Part cannot access the configuration list. This is probably caused by insufficient permissions. Contact your system administrator. ---> System.Threading.ThreadAbortException: Thread was being aborted. at System.Threading.Thread.AbortInternal() at System.Threading.Thread.Abort(Object stateInfo) at System.Web.HttpResponse.End() at Microsoft.SharePoint.Utilities.SPUtility.Redirect(String url, SPRedirectFlags flags, HttpContext context, String queryString) at Microsoft.SharePoint.Utilities.SPUtility.RedirectToAccessDeniedPage(HttpContext context) at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(HttpContext context) at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex) at Microsoft.SharePoint.Library.SPRequest.GetListsWithCallback(String bstrUrl, Guid foreignWebId, String bstrListInternalName, Int32 dwBaseType, Int32 dwBaseTypeAlt, Int32 dwServerTemplate, UInt32 dwGetListFlags, UInt32 dwListFilterFlags, Boolean bPrefetchMetaData, Boolean bSecurityTrimmed, Boolean bGetSecurityData, Boolean bPrefetchRelatedFields, ISP2DSafeArrayWriter p2DWriter, Int32& plRecycleBinCount) at Microsoft.SharePoint.SPListCollection.EnsureListsData(Guid webId, String strListName) at Microsoft.SharePoint.SPListCollection.Undirty() at Microsoft.SharePoint.SPBaseCollection.GetEnumerator() at System.Linq.Enumerable.<CastIterator>d__aa`1.MoveNext() at System.Linq.Enumerable.WhereEnumerableIterator`1.MoveNext() at System.Linq.Enumerable.FirstOrDefault[TSource](IEnumerable`1 source) at Microsoft.EnterpriseManagement.SharepointIntegration.SPListCollectionExtensions.GetList(SPListCollection lists, String listName) at Microsoft.EnterpriseManagement.SharepointIntegration.PortalConfigurationCollection.<>c__DisplayClass2.<.ctor>b__0() --- End of inner exception stack trace --- at Microsoft.EnterpriseManagement.SharepointIntegration.PortalConfigurationCollection.<>c__DisplayClass2.<.ctor>b__0() at Microsoft.SharePoint.SPSecurity.<>c__DisplayClass4.<RunWithElevatedPrivileges>b__2() at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode) at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(WaitCallback secureCode, Object param) at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(CodeToRunElevated secureCode) at Microsoft.EnterpriseManagement.SharepointIntegration.PortalConfigurationCollection..ctor(String listName) at Microsoft.EnterpriseManagement.SharepointIntegration.PortalConfiguration.TryInitializeWebPartConfiguration(PortalWebPart webPart, PortalConfiguration& configuration, String& errorMessage) 616c88fc-47d7-4ac0-b155-da3d7859e21c

Resolution

After some digging we realized that it was failing for a list on Central Administration,in order to fix this make sure your web application pool has permissions to add to “Operations manager web console environments” (https://Central administration site/operationsmanager)

There are high chances that you will get another Access denied and following will be get logged in the ULS log

System.Data.SqlClient.SqlException: The EXECUTE permission was denied on the object 'proc_EnumLists', database 'SharePoint_AdminContent_b87e98fd-b2fc-49c0-8025-aef8851561ea', schema 'dbo'.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)   
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)   
at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)   
at System.Data.SqlClient.SqlDataReader.ConsumeMetaData()   
at System.Data.SqlClient.SqlDataReader.get_MetaData()   
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)   
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)   
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)   
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)   
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method)   
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior)   
at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior, SqlQueryData monitoringData, Boolean retryForDeadLock)

In order to fix this we need to grant Web Applications Application Pool DBO rights to the Central Administration Content Database