Using PowerShell to delete user's permissions?

Question

Hello Forum,
I am an accountant with zero backgroud in IT. I happen to be responsible on managing our small SharePoint 2010 environment (10 Web Applications, 20 Site Collections in each Web Application, and 300 Users), and even though it been a quite difficult task, I must
admit that I am kinda enjoying it because I get a chance to learn new things.
Whenever I encounter an issue, I google it up and most of the time I find answers on the Internet. Nevertheless, This time I think I am having a tough problem, that's why I have decided to register and post my question for the first time ever. 
Well, I have a few users who have left our company, and they have permissions all over the place, some of these users have Full Control and Contribute permissions on different Site Collections, SubSites, Lists, and libraries across the Web Applications that
we have.
Unfortunately, We do not have a proper governance process in place, and yes things are messy in our SharePoint environment, I have noticed that some of these users were granted permissions on Lists and Libs directly without using any User Groups.
Now, It is my responsability to clean up the environment. I have spent most of my weekend guessing and cleaning up manually our SharePoint environment, by jumping from Site to another and checking through the UI and removing the user from there, But this repeated
manual work is killing my soul I swear.
I read a bout PowerShell and I managed to test simple commands and I hope it is the way to go. I have been using this small script:
$web = Get-SPWeb http://MySharePointSite
$user = get-spuser -Identity Domain\UserAccount -Web $web.url
$list = $web.Lists["Docs/Pics Library"]
$list.RoleAssignments.Remove( $user)
But again, Even though it is a bit faster than working with UI, I feel it not efficient enough because have to run it against every List, Docs Lib, Pics Lib...etcs
So guys, Is there a way in PowerShell that allows me to give the user account and the Web Application URL as parameters, and the script runs and loops through the entire Web Application with all its Site Collections and SubSites, Lists, Libs and remove that
user from there completely regardless if that user was added diretly or in a group?
Can PowerShell automate such a process or am I dreaming?

Answer 1

Yes it can.
However before we get there, we should note something: If you're using Active Directory (AD) for your users, and you almost certainly are, as long as the leaver's account is marked as 'Disabled' in there then security wise you're fine. The rest is just to
keep things clean.
If you search a bit longer you'll probably find a more complete script but to extend yours a bit we can do a few things. What we want to do is introduce 'loops'. I'm assuming you know nothing about programing but a loop is a process where the code does a
certain activity for a set number of times or until it reaches a point to finish.
What we'll do is use three 'get things' commands to get all the sites, all the webs in a site and then all the lists in a web to get us a list of things to run our loop on, then run your remove code.
#This gets all the site collections you have permission to see
$sites = Get-SPSite -Limit All
#This loops through each site collection and calls it 'siteCollection'
foreach ($siteCollection in $sites)
#This gets all the webs in the site collection
$webs = $siteCollection.AllWebs
#This loops through all the webs
foreach ($website in $webs)
$user = get-spuser -Identity Domain\UserAccount -Web $website.url
#This gets all the lists in the library
$lists = $web.Lists
foreach ($list in $lists)
$list.RoleAssignments.Remove( $user)
Now this isn't great code, there's lots of ways it may not work perfectly but it shouldn't break anything. One thing you should remember is to close the PowerShell session once you've run it as this will suffer from memory leaks (where it keeps eating up
RAM until you close the application).
Another thing, have you discovered PowerShell ISE yet? It's vital if you want to do semi complicated PowerShell.
Welcome to the wonderful world of SharePoint and PowerShell. If you want let me know and i can point you to some nice gentle 'how to' resources.
And finally, this isn't the solution to your entire problem but it will do a decent chunk of it for you and could serve as a starting point to doing the entire lot...