6/14/2014

SharePoint Check Out and Check In Issues

 

As I work to complete my SharePoint security book (only three years so far), I've been testing just about every combination of permissions looking for benefits and side effects. While working on a custom permission level with minimum permissions for an Add, Edit but not Delete user I ran into some interesting issues with Check Out and Check In.

Access Denied… You would think that Check Out and Check In are core document management features that would be available to any user who can edit a document. Turns out two unlikely permissions are needed: Browse User Information and Use Remote Interfaces.

 

Access Denied when checking in a document. (2010 and 2013 on prem and 365)

image   image

Solution:

User must have the Browse User Information permission to check in files! (This is included in the Contribute permission level.)

This one is certainly not obvious, and could be an issue if you removed this permission to hide the ability to view other users in the site.

 

Access Denied when checking out a document (2010)

image

Solution:

User must have the Use Remote Interfaces permission to check out files! (This is included in the Contribute permission level.)

This one is certainly not obvious, and could be an issue if you removed this permission to hide the ability to view other users in the site.

Looks like Microsoft made a change in SharePoint 2013 so that this one is no longer an issue.

 

.

6/08/2014

New SharePoint PowerShell Course 55095AC

 

PS C:\> Get-PSScripts | Organize-PSScripts | Create-MAXClass

I've written and collected SharePoint scripts for the last several years with the idea of one day turning them into a book or a class. I've finally pulled together a class from the scripts in this blog, from the PowerShell chapter of my SharePoint security book and from examples created for my classes. Turns out there are over 175 examples in the final class.

This class was a lot of fun to right, but it had a major challenge, limiting what I put into it. As there is a lot of good content on the web for SharePoint server administration, I focused this class on the rest of us who need to find stuff and answer those random management questions. You know, those kinds of things that a SharePoint governance auditor might need to do, and the kind of weird questions that SharePoint administrators get every day.

The class has been uploaded to the Microsoft Courseware Marketplace and should be available to training centers in a few weeks as course 55095AC. Check out the MAX Technical Training web site for the dates when I will be delivering the class. The next date is July 24th. At MAX you can attend local classes in Cincinnati or attend as a remote student from anywhere!


SharePoint 2010 and 2013 Auditing and Site Content Administration using PowerShell

Course #:                                      55095AC

Number of Days:                                         1

Format:                               Instructor-Led

Certification Exams:                           None

This one day class is designed for SharePoint 2010 and 2013 server administrators and auditors who need to query just about anything in SharePoint. The class handout is effectively a cheat sheet with over 175 PowerShell scripts plus the general patterns to create your own scripts. These scripts cover:

·        using the SharePoint Management Shell and the ISE

·        general tips for counting, reformatting and exporting results;

·        understand and drilling up and down the SharePoint object model

·        getting lists / inventories of servers, services web applications, sites, webs, lists, libraries, items, fields, content types, users and much more

·        finding lists by template type, content type and types of content

·        finding files by user, content type, file extension, checked out status, size and age

·        finding inactive sites

·        finding and changing SharePoint Designer settings and finding and resetting customized pages

·        inventorying and managing features

·        deleting and recycling files and list items

·        inventorying users and user permissions and finding out “who can access what”

·        creating sites, lists and libraries

·        uploading and downloading files

·        and much more…

Audience

·        SharePoint server administrators.

·        SharePoint auditors.

·        Also valuable for SharePoint developers.

 

At Course Completion

After completing this course, students will be able to:

·        Use PowerShell to query just about anything inside of SharePoint.

·        Understand the core SharePoint object model and object hierarchy as seen from PowerShell.

·        Format PowerShell output in to reports.

·        Manage resources to limit the impact on production servers.

·        Create and delete Site Collections, subsites, lists, libraries and content.

 

Prerequisites

Before attending this course, students must:

·        Very good knowledge of SharePoint and its features.

·        Good experience using PowerShell 2 or later or recent completion of a PowerShell class such as 10961 or 50414.

 


 

Module 1:  SharePoint and PowerShell

This module provides an introduction to the topics covered in the class, introduces SharePoint PowerShell terminology and provides a review of important PowerShell features.

 

Lessons

§  History of PowerShell in SharePoint

§  PowerShell vs. Search

§  PowerShell, SharePoint Management Shell and cmdlets

§  Security and Permissions Needed

§  Getting Started with PowerShell: Counting Items, Custom Columns, Reformatting Numbers, Saving Results to a File

§  Changing and Updating Content: Creating SharePoint Objects, Changing Objects

 

Lab:

§  Using PowerShell with SharePoint

 

 

After completing this module, students will be able to:

§  Get started using PowerShell to inventory and update SharePoint.

 

Module 2: Working with SharePoint CMDLETs and Objects

This module introduces the SharePoint object model and some important terminology.

 

Lessons

§  GUIDs

§  Sites vs. Webs

§  The SharePoint Object Hierarchy

 

Lab:

§  Get a list of all Site Collections and their GUIDs

§  Get a list of all Webs in all Site Collections

§  Given a web’s URL get its parent web and web application

 

After completing this module, students will be able to:

§  Explore sites and webs using PowerShell.

§  Retrieve important properties of common SharePoint objects

 

Module 3: Managing Memory and Limiting Performance Impact

This explores limiting impact on server memory usage and performance.

 

Lessons

§  Memory Management and Disposing Objects

§  Limiting Impact on Production Servers

 

Lab:

§  Exploring PowerShell’s use of system memory.

§  Testing the impact of scripts on server performance

 

After completing this module, students will be able to:

§  Recognize and manage the impact of PowerShell on a SharePoint server.

 

 

Module 4: Working with Content

This module explores SharePoint using PowerShell from the Farm down to individual list items.

 

Lessons

§  Getting Farm Information: version, services, services, features

§  Getting Web Application information

§  Exploring Site Collections: retrieve Site Collections, Site Collection Administrators, quotas

§  Working with the Recycle Bins: finding items, getting file counts and bytes, deleted sites

§  Exploring Webs: web templates, finding webs, finding webs based on template, Quick Launch and Top Link Bar navigation

§  Exploring Lists and Libraries: finding all lists, lists by type, lists by Content Type, columns/fields, document count by web or library

§  Exploring Content Types

§  Finding documents: by a word in the title, file type, content type, size, date age, checked out status, approval status and many more…

§  Deleting content

§  Downloading and uploading files

 

Lab:

§  Explore the farm.

§  Inventory site collections.

§  Create a recycle bin report.

§  Finding all blog sites.

§  Find all picture libraries.

§  Find all PDF files over 5 MB.

§  Delete all videos in a site collection.

 

After completing this module, students will be able to:

§  Explorer, inventory and maintain SharePoint content using PowerShell.

 

Module 5: Users and Security

This module covers the use of PowerShell to explore and document SharePoint permissions.

 

Lessons

§  Users: find a user, get a list of all users, working with Active Directory groups

§  SharePoint groups: Get lists of groups, get the members of a group, find all groups a user belongs to, find the groups associated with a web

§  Expanding users lists that include Active Directory groups

§  Documenting Broken Inheritance / Unique Permissions: webs, lists, libraries, folders, items

§  Working with Role Assignments

 

Lab:

§  Get a list of all users who have access to a Site Collection.

§  Get a list of all groups in a Site Collection.

§  Get a list of all groups a user belongs to.

§  List all users who may have access to a SharePoint securable.

§  Get a list of all securables with broken inheritance.

 

After completing this module, students will be able to:

§  Explore and document users and user permissions.

§  Explore and document SharePoint groups.

§  Explore and document broken inheritance.

 

 

 

Module 6: Managing Sites

This module explorers Site Collection and Web management from PowerShell.

 

Lessons

§  Finding Inactive Webs

§  Creating and Deleting Site Collections

§  Getting Site Collection Data

§  Creating and Deleting Subsites

§  Working With SharePoint Designer Settings

 

Lab:

§  Create a report for inactive sites.

§  Create a site collection and subsites.

§  Delete a site.

§  Delete a site collection.

§  Disable SharePoint Designer in all site collections.

 

 

After completing this module, students will be able to:

§  Manage SharePoint Site Collections and webs from PowerShell.

 

.

6/05/2014

SharePoint User Policy, Super Users and Auditors

 

I ran across a question in the TechNet forums today that revolved around confusion about the purpose of the Site Collection Permissions section in the Permission Policy dialog box in Central Administration. In Central Administration, in the Web Application Management section, there are two ribbon buttons that let you define web application scoped permissions: Permission Policy and User Policy. These are typically used to deny something from everyone or grant something to a few special users. These always win over any permissions changes done by a Site Owner.

image

Creating a Super User

A super user might be an auditor who needs read-only access to everything in a web application, or a super administrator who needs Site Collection Administrator permissions to everything in a web application.

Steps:

  1. Go to Central Administration, click Application Management and Manage Web Applications.
  2. Click in the line (but not on the hyperlink) for the web application to change. This wakes up the ribbon.
  3. Click Permission Policy.
  4. Click Add Permission Policy Level

Here's where it gets a little confusing… there's two ways of creating a policy, check each individual Grant or Deny, or click one of the two shortcuts: "Site Collection Administrator" or "Site Collection Auditor". Is it clear from the descriptions below that these are shortcuts, right?

image

It's even more confusing when you check one of these two options and then click Save:

image

There's a bug! The Save button has some validation JavaScript that is checking to see that at least one checkbox has been selected. The fix? Select a checkbox. I click "Open" in the Grant column because that is the minimum permission needed to open a site. Now you can click Save.

 

If you check Site Collection Auditor…

The "Site Collection Auditor" shortcut checkbox grants these permissions to the user:

View Web Analytics Data
Browse Directories
View Items
View Pages
Enumerate Permissions
Open Items
View Versions
Browse User Information
View Application Pages
Use Remote Interfaces
Open

Actually clicking Save will grant the above permissions when "Site Collection Auditor" has been checked, and include any other Grants or Denys you have clicked. (Deny always wins over Grant!)

 

If you check Site Collection Administrator…

The "Site Collection Administrator" shortcut checkbox grants all 33 permissions to the user, minus any Denys you have checked. (Deny always wins over a Grant!)

Manage Permissions
View Web Analytics Data
Create Subsites
Manage Web Site
Add and Customize Pages
Manage Lists
Apply Themes and Borders
Apply Style Sheets
Override Check Out
Manage Personal Views
Add/Remove Personal Web Parts
Update Personal Web Parts
Add Items
Edit Items
Delete Items
Create Groups
Browse Directories
View Items
Use Self-Service Site Creation
View Pages
Approve Items
Enumerate Permissions
Open Items
View Versions
Delete Versions
Browse User Information
Create Alerts
Manage Alerts
View Application Pages
Use Remote Interfaces
Use Client Integration Features
Open
Edit Personal User Information

All of the above would have been a lot clearer if when you clicked on of the "shortcuts" the page automatically checked all of the related permissions.

 

Testing

  1. Create a user, such as domain\allieauditor (or ask a coworker to help).
  2. Go to a site collection and click Site Actions, Site Permissions.
  3. Click the Check Permissions button in the ribbon and click Allie's permissions. You should see "none".
    image
  4. Go to Central Administration and add a Permission Policy.
    1. Name it "Corp Auditor".
    2. Check "Site Collection Auditor".
    3. also check one other permission such as "Open" to make the Save button happy.
  5. In User Policy:
    1. Click Add Users
    2. Click Next
    3. Add domain\allieauditor and check "Corp Auditor"
    4. Click Finish
  6. Go the test site click Check Permissions and check Allie's permissions.
    The following are displayed (all "read" type permissions) for Allie:
      View Web Analytics Data
      Browse Directories
      View Items
      View Pages
      Enumerate Permissions
      Open Items
      View Versions
      Browse User Information
      View Application Pages
      Use Remote Interfaces
      Open
  7. Go back to User Policy and remove Allie as "Corp Auditor"
  8. In the test site check her permissions: None
  9. Create a new policy
    1. Name it "Super Administrator".
    2. Check "Site Collection Administrator".
    3. Also check one other permission such as "Open" to make the Save button happy.
    4. Click Save.
  10. Return to the test site and check Allie's permissions. She now has all 33 permissions.

 

Tip… Is a user a "normal" user or a "super user"?

When you use Check Permissions and you see a permission level, then you have found a "normal" user who was granted permissions by the Site Owner. As you can see below, Sam has the Contribute permission level.

image

If you see all 33 permissions, then you have either found a Site Collection Administrator or a "super user" created by the server administrator. Stella is a Site Collection administrator, but could also be a "super administrator" created though User Policies.

image

If you see any "Allow" or "Deny" entries, then you have found a user who has been granted or denied permissions using Central Admin's User Policy button. In the example below Sam is a Full Control site owner, except… he has been denied Create Subsites in User Policies. (Deny always beats Grant!)

image

.

Note to spammers!

Spammers, don't waste your time... all posts are moderated. If your comment includes unrelated links, is advertising, or just pure spam, it will never be seen.