Tag Archives: backup

SharePoint Permission Back Up and Restore in PowerShell

Hi SharePoint Admins! I’ve recently worked on a module to enhance SharePoint Backup experience. If you haven’t known SharePoint Native Backup enough, please read this.  SharePoint Native backup supports Backup-SPFarm, Backup-SPSite, Backup-SPFarm, Export-SPWeb.

All these approaches backup the actual content of the file and at times requires the entire Site or List to be restored entirely. If you are using Version History feature, recovering file can be made easier by restoring only the mis-updated files. In additional, the introduction of Recycle Bin since SharePoint 2010 has helped many SharePoint Admins (at least for myself) to recover accidentally deleted files without burning much of your time.

However, there is no Version History for Permission. Whatever permission changes that you have made onto a document, library or site do not keep a backup copy for you to restore in the later time. You can tap on third party product to help you on this, downside is, you have to pay for the service. Some 3rd party products that you can find in the markets are like Lightning Tools and AvePoint . (Personally never tried that but I’m more of a Self Fulfilling kind, where everything can be done by my left hand and my right hand. But please don’t get me wrong, paying more for premier service sometimes can be good as it comes with support and service level assurance)

So much for the introduction, now let’s go into the script!

I uploaded my script to CodePlex – PowerShell to backup/restore SharePoint Webs, Libraries, Folders and Files and inside the source code, you can find two powershell script, namely BackupPermission.ps1 and RestorePermission.ps1.

You would first run the BackupPermission.ps1. This backuppermission.ps1 generates a Permission.xml file that you gonna need it for the RestorePermission.ps1 later.

What this Backuppermission.ps1 does is to loop through your entire SharePoint Farm for Site Collections. Subsequently, for each of the site collection, it back up its Root Web permissions and Sub Web permissions. After backing up the web level permission, it goes to back up all document libraries permission, folder permission within each library and optionally (turn on by default) files permission.

Why do I need to care about backing up the permission? Well, there may have many reasons for that but below are just some for myself…

  1. You screw up the permission and can’t afford to restore the SharePoint Site Collection (cause only Backup-SPFarm was running DAILY)
  2. You do not want to inform the user for backup recovery cause the user will scream at you if the data that you going to restore has been modified by the user.
  3. You do have full confidence to run SharePoint Native Restore-SPSite as you all know, some times it doesn’t Work. Some how.. (MS, no offense on this, well, it does work most of the time but reason 1 superseded this)
  4. You accidentally RESET or Hit the “Delete Unique Permission” button when trying to change a WEB permission. Refer to my previous post on why this will kill your document permission.

 

Here I’m gonna talk about the Permissions.xml that is generated by my BackupPermission.ps1. You can always change the XML to suit your backup needs. Things like Restoring only partial of your Site Collection, restoring only a document library and even up to only a folder or file. By default, if a entity does not contains <RoleAssignments> node, the RestorePermission.ps1 script will bypass updating the permission and it will remains as its current stage (could be Inherting its parent permission or already broken permission. no changes will be done).


<?xml version="1.0" encoding="UTF-8"?>
<SharePoint>
 <Sites>
  <Site>
   <Url>https://mysharepoint.com</Url>
   <RootWeb>
    <Title>SharePoint Portal</Title>
    <Url>https://mysharepoint.com</Url>
    <RoleAssignments>
     <RoleAssignment User="i:0#.w|contoso\appadmin">
      <RoleDefinitionBindings>
       <RoleDefinition Name="Full Control"/>
      </RoleDefinitionBindings>
     </RoleAssignment>
     <RoleAssignment Group="SharePoint Portal Owners">
      <RoleDefinitionBindings>
       <RoleDefinition Name="Full Control"/>
      </RoleDefinitionBindings>
     </RoleAssignment>
     <RoleAssignment Group="SharePoint Portal Visitors">
      <RoleDefinitionBindings>
       <RoleDefinition Name="Read"/>
      </RoleDefinitionBindings>
     </RoleAssignment>
    </RoleAssignments>
    <Lists>
     <List>
      <Title>Documents</Title>
      <RootFolder>
       <Name>Documents</Name>
       <Url>Documents</Url>
       <SubFolders>
        <Folder>
         <Name>Folder A</Name>
         <Url>Documents/Folder A</Url>
         <RoleAssignments>
          <RoleAssignment Group="SharePoint Portal Owners">
           <RoleDefinitionBindings>
            <RoleDefinition Name="Full Control"/>
           </RoleDefinitionBindings>
          </RoleAssignment>
          <RoleAssignment Group="SharePoint Portal Visitors">
           <RoleDefinitionBindings>
            <RoleDefinition Name="Read"/>
           </RoleDefinitionBindings>
          </RoleAssignment>
          <RoleAssignment Group="SharePoint Portal Members">
           <RoleDefinitionBindings>
            <RoleDefinition Name="Contribute"/>
           </RoleDefinitionBindings>
          </RoleAssignment>
         </RoleAssignments>
        </Folder>
        <Folder>
         <Name>Folder B</Name>
         <Url>Documents/Folder A - Copy (8)</Url>
        </Folder>
       </SubFolders>
       <Files>
       </Files>
      </RootFolder>
     </List>
    </Lists>
    <Webs>
    </Webs>
   </RootWeb>
  </Site>
 </Sites>
</SharePoint>

What you are seeing above basically showing a backup xml that if you restore using this, only 1 site “https://mysharepoint.com” will be processed.  The permission of this site will have the following permission

  • appadmin (SPUser) – Full Control
  • SharePoint Portal Owners (SPGroup) – Full Control
  • SharePoint Portal Visitors (SPGroup) – Read

Subsequently, the script will continue to loop and restore List (in my backup script, this node stores only document libraries.) with Title “Documents” which is inheriting parent permission.

Folder “Folder A” within this document library will have unique permission while “Folder B” will inherit library permission which follows the Web permissions.

 

Well if you don’t really care at all, simply running BackupPermission.ps1 and RestorePermission.ps1 should be able to help you recovering you web permission.

To complete the entire process, set a Task Scheduler job to backup your farm permission regularly!

Scripting your SharePoint Farm Backup with PowerShell in Task Scheduler

Hi guys,

Today, I would like to share one of the SharePoint admin must-do deployment steps which is to configure a task scheduler and to backup your SharePoint Farm. Note that this is working for both 2010 and 2013 environment.

Also, I’m leveraging this SP Farm Backup script created by good people (thanks for making this powerful and useful script). Please ensure that you have downloaded them and configure the params.xml file base on your corporate needs.

For the interest of those who want to just reference my configuration, below are the xml I used for my SharePoint Farm


<?xml version="1.0" encoding="utf-8"?>
<backup version="2.3">
 <params>
 <backupserver>SERVER_HOST_NAME</backupserver> <!-- Name of server if backup share is on remote server -->
 <sendemail>TRUE</sendemail> <!-- Option: TRUE/FALSE -->
 <smtpserver>SMTP_IP</smtpserver>
 <environment>My SharePoint (Staging)</environment>
 <emailfrom>yihaa_5@hotmail.com</emailfrom>
 <emailto>yihaa_5@hotmail.com</emailto> <!-- Multiple recipients must be comma separated -->
 <emailcc></emailcc> <!-- Multiple recipients must be comma separated -->
 <backupwebconfigonly>FALSE</backupwebconfigonly> <!-- IMPORTANT: If set to TRUE then web.config is backed up and NOT Virtual Directories -->
 <exportsolutions>TRUE</exportsolutions> <!-- Option: TRUE/FALSE -->
 <backupiis>TRUE</backupiis> <!-- Option: TRUE/FALSE -->
 <backupgac>TRUE</backupgac> <!-- Option: TRUE/FALSE -->
 <backupulslogs>TRUE</backupulslogs> <!-- Option: TRUE/FALSE -->
 <backup14hive>FALSE</backup14hive> <!-- Option: TRUE/FALSE -->
 <backupfulldays>Sunday</backupfulldays> <!-- Used in conjunction with option 1 of backupoption - Days must be comma separated -->
 <backupthreads>1</backupthreads> <!-- Option: 1 to 10 -->
 <backupsites>TRUE</backupsites> <!-- Option: TRUE/FALSE -->
 <includemysites>FALSE</includemysites> <!-- Option: TRUE/FALSE -->
 <backupconfigonly>FALSE</backupconfigonly> <!-- Option: TRUE/FALSE -->
 <backupshare>FarmBackup</backupshare>
 <backupoption>0</backupoption> <!-- Option: 0/1/2 -->
 <daystoretain>30</daystoretain> <!-- No. of days backups to retain (Must be greater than 1 day. Default: 7 days)-->
 </params>
</backup>

The key consideration of the above configuration is on the number of days to retain (daystoretain). You would need to really consult your technical manager in order to craft out the backup data retention period.

Once you have the SP Farm Backup script ready,  create a text file name “CreateTaskSchedulerForSPBackup” and subsequently change the extension to “.ps1” file (PowerShell extension).

Copy the below PowerShell script into the newly created CreateTaskSchedulerForSPBackup PowerShell


$A = New-ScheduledTaskAction -Execute "F:\TaskScheduler\Farm-Backup.bat" -WorkingDirectory "F:\TaskScheduler\"
$T = New-ScheduledTaskTrigger -Daily -DaysInterval 1 -At (Get-Date).Date
$S = New-ScheduledTaskSettingsSet

Register-ScheduledTask -Action $A -User "$($env:USERDOMAIN)\spfarmadmin" -Trigger $T -Settings $S -Force -TaskName "SharePoint Farm Backup" -RunLevel 1 -Password "xxxxxxxx"

For above PowerShell, there are certain things that you need to change based on your environment.

Farm-Backup.bat Path

It is assuming that you have copied all the SP Farm Backup downloaded script (together with your params.xml) into F:\TaskScheduler\ Folder of the server running the task scheduler. You only need to configure Task Scheduler in 1 of your SharePoint server only.

Task User Account

For most of the environment, your SP Farm Admin account is not always the local admin account where you access the server and create the task schedule. You will have to explicitly specify the Farm Admin account in the PowerShell as well as the Password of this account so that when the task is running, it takes in the Farm Admin account to perform Backup.

You need to use Farm Admin account to execute the backup script. Else you will hit access denied during the backup job.

Note that your password is entered in plain text. If you wish not to dispose the Password in Script. You can refer to last section on how to do it.

Backup Directory

It is also assume that you have created a Shared Folder in the server where you want to store the backup files. It must be a Network Shared Folder. In my example, it will be in “\\SERVER_HOST_NAME\FarmBackup” . 

Few things you need to consider when creating this shared folder:

  • Central Admin app pool account must have read/write access to the location of the backups.
  • SQL Service account must have read/write access to the location of the backups.
  • When running a farm backup from STSADM or Windows PowerShell, the account you’re running it as must have read/write access the location of the backups.
  • The location must be accessible from the SharePoint machine the backup is running on.
  • The location must be accessible from the SQL instance that SharePoint is trying to back up.

automated task scheduler for SharePoint Backup

Now that you have the script, kindly open PowerShell with Administrator rights in the server where you want to create the Task Scheduler.

Run the CreateTaskSchedulerForSPBackup.ps1

To double check if the task is created successfully, you go to Task Scheduler (taskschd) and check. The task “SharePoint Farm Backup” will be created.

automated task scheduler for SharePoint Backup output

How to avoid storing password into PowerShell Script.

As mentioned just now, you may want to avoid storing your password into the PowerShell Script.

In order to do that, you can use the PowerShell Script below to archive that.


$password = Read-Host -AsSecureString "Enter your password and hit Enter"
$bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($password)
$plainPassword = [RunTime.InteropServices.Marshal]::PtrToStringAuto($bstr)

Register-ScheduledTask -Action $A -User "$($env:USERDOMAIN)\spfarmadmin" -Trigger $T -Settings $S -Force -TaskName "SharePoint Farm Backup" -RunLevel 1 -Password $plainPassword

Save the CreateTaskSchedulerForSPBackup.ps1 and reruns it via PowerShell.

I hope the script to create task schedule can save you some time. It happens to me that manually creating Task Scheduler can be very error prone as there are many clicking in the Task Scheduler UI, repeating the same creation steps in difference farm environment can be very tedious too.