Setting multiple site collections to read only in SharePoint using PowerShell

A feature that has been around in SharePoint for a while now is the capability to set site collections and content databases to read only – the former being a property on the site collection in SharePoint and the latter by setting the database directly in SQL Server. This feature hides and disables all the write-based functions on a site, for example, uploading documents, creating and editing list items, etc.

It is commonly used in migration scenarios to prevent users from adding content whilst their sites are being moved to a new platform – once the migration has been completed then their site collections can be set back to read/write again.

The easiest, and perhaps most fool-proof way to do this is to set the database as read only in SQL Server, as this will disable the write function on all site collections in one quick change. However, there may be occasions where you may prefer to set it at the site collection level. Typically, this is preferred in scenarios where you wish to enable or disable the read only feature on individual site collections at different times during a migration, perhaps where there is more urgency to control read/write access for specific teams either earlier or later in the migration phase.

The script in this article walks through each Web application (except Central Administration), each content database mounted to the Web application, and finally each site collection in the content database and sets the ReadOnly property to either True (content cannot be created) or False (content can be created). I have also built in an “excluded paths” feature, that allows you to specify individual site collections or entire Web applications from being modified by the script.

First, launch the SharePoint Management Shell (or preferred alternative PowerShell editor) and type the following line to choose whether to set the ReadOnly property to True or False. In the example, I am going to set site collections to read only mode:

# Define whether ReadOnly will be set to true or false
[bool]$readOnly = $true

Next, build the $excludedPaths variable to specify any site collections or Web applications that you wish to exclude from modification by the script. If you would like the script to exclude entire Web applications, then you must add a trailing slash to the URL – e.g., “http://mysite.domain.lab/”. To exclude site collections only, leave off the trailing slash – e.g., “http://mysite.domain.lab”. This functionality allows you to exclude root site collections from being modified but not the entire Web application – for example, you may want to leave the My Site Host site collection read/write but set all the personal sites in the My Site Web application to read only.

Note: Each URL is in quotes and comma-separated:

# Set excluded paths as comma-delimited strings
# Note: Web applications must end in a trailing slash, where site collections do not
[array]$excludedPaths = "http://applications.domain.lab/",
                        "http://mysite.domain.lab",
                        "http://portal.domain.lab/sites/siteA",
                        “http://portal.domain.lab/search”

Now the remainder of the script, which will walk through each site collection in the farm, setting the ReadOnly property as explained earlier:

# Get all Web applications (except Central Admin)
Get-SPWebApplication | ForEach-Object {
   
    if ($excludedPaths -notcontains $_.Url)
    {
        # Enumerate all content databases in each Web application
        if ($_.ContentDatabases -ne $null) {
            $_.ContentDatabases | ForEach-Object {
           
                # Enumerate all site collections in each content database
                if ($_.Sites -ne $null) {
                    $_.Sites | ForEach-Object {
                       
                        # Check if there are sites where the property should not be changed
                        if ($excludedPaths -notcontains $_.Url)
                        {
                            Write-Host "Changing ReadOnly property for site" $_.Url
                           
                            # Set ReadOnly property
                            $_.ReadOnly = $readOnly
                            Write-Host "ReadOnly property for site" $_.Url "set to" $_.ReadOnly
                           
                            # Dispose site collection object
                            $_.Dispose()
                        }
                        else
                        {
                            # Confirm if no changes made on excluded sites
                            Write-Host "No changes made for site" $_.Url
                        }
                    }
                }
            }
        }
    }
    else
    {
        # Confirm if no changes made on excluded web applications
        Write-Host "No changes made for web application" $_.Url
    }
}

The script above will display a list of modified site collections in the PowerShell console as it changes them, and also confirm the Web applications and site collections that were excluded from the process. Should you lose track of which site collections have been set to read only and which ones haven’t, then you can easily generate a status report in the console by using the following script:

# Get all Web applications (except Central Admin)
Get-SPWebApplication | ForEach-Object {
    # Enumerate all content databases in each Web application
    if ($_.ContentDatabases -ne $null) {
        $_.ContentDatabases | ForEach-Object {
            # Enumerate all site collections in each content database
            if ($_.Sites -ne $null) {
                $_.Sites | ForEach-Object {
                    Write-Host "ReadOnly property for site" $_.Url "set to" $_.ReadOnly
                    # Dispose site collection object
                    $_.Dispose()
                }
            }
        }
    }
}

For additional info, the scripts in this article could be used to get or set other site collection properties, too. For example, the Portal Site Connection property, SharePoint Designer permissions, or Site Collection Administrators. See this article on MSDN for a full list of properties available for configuration on site collections, including ReadOnly.