I want to know the users who all have access Read/Write to particular item. How to fetch that info? is there any SQL table to extract?

3 Answers 3


You cannot do this via SQL query - you need to use Sitecore API. The reason is that Sitecore security model allows inheritance of access rights, breaking the inheritance and denying access rights. You cannot really read it from the tables directly.

Using API:

  1. Get the user by the name:
var user = Sitecore.Security.Accounts.User.FromName(userName, false);
  1. Check access write:
using (new Sitecore.Security.Accounts.UserSwitcher(user))
    bool canWrite = item.Security.CanWrite();

Now you only need to iterate through all the users and run that code for each of them. Something like this should do the trick:


EDIT after OPs comment: If you want to execute check for more items, you must either put your whole code inside using UserSwitcher block or use UserSwitcher.Enter and UserSwitcher.Exit like:

using (new Sitecore.Security.Accounts.UserSwitcher(user))
    bool canWriteParent = parent.Security.CanWrite();
    for (Item child in parent.Children)



bool canWriteParent = parent.Security.CanWrite();
for (Item child in parent.Children)

// any other code

  • That's not what I would expect. item.Security.CanRead should take into account inherited access rights as well. Are you sure you switched context to that user? Have you checked with Access Viewer application if user has that access? Maybe there is some Deny rule which does not allow user to read that item?
    – Marek Musielak
    Commented Nov 19, 2018 at 8:55
  • Sure will check...Marek and will update Commented Nov 19, 2018 at 9:45
  • It worked....I have one more doubt...my requirement is to get access info for parent first, if it returns false I will check for child items. If any of the child item has access return true. If parent and none of the child items has access then return false. Do I have to use switch user everytime I use this .canread function? Commented Nov 22, 2018 at 4:50
  • I edited the answer with comment for your latest question
    – Marek Musielak
    Commented Nov 22, 2018 at 6:46
  • Thank you so much marek....one last question...I am trying to give role wise access now... creating a role and adding the same user to that role and giving access to the role...In this case also I can use the same code right? Else is there any separate API to check the role-wise access? It would be great if you can provide some links for reference also so that i can explore Commented Nov 22, 2018 at 7:38

If you are already logged into Sitecore, you can also use the built-in tools in the Sitecore interface, though they require a little more manual hunting to check all users.

Security Details

In the Content Editor, click the Details button of the Security ribbon tab:

Security details button in content editor

This will open a tab in the content editor that shows you all the security for the assigned item, though it will not show you inherited security:

Security details tab

Access Viewer

Open it from the Security ribbon tab of the Content Editor to pre-select the currently-selected item:

Access viewer from content editor

It can also be opened directly from the LaunchPad or from the Sitecore menu in Desktop:

Access viewer in desktop menu

You can then select different items to see their security for specific accounts (change which account is to be tested by clicking the Account button in the Access Viewer ribbon).

Access viewer

  • I am trying to build a SOAP service....to check particular item access...So accessing through API is required Commented Nov 19, 2018 at 6:50

Another option would be to generate a report using Sitecore Powershell Extensions:

function Get-Items () {
    # Set the item you want to check here
    $item = Get-Item -Path "master:/sitecore/content/"

    $finalUserList = New-Object System.Collections.Generic.List[System.Object]
    $users = [Sitecore.Security.Accounts.UserManager]::GetUsers()
    foreach ($user in $users) {
        New-UsingBlock (New-Object Sitecore.Security.Accounts.UserSwitcher $user) {
            if ($item.Access.CanRead()) {
                if ($item.Access.CanWrite()) {


$props = @{
    InfoTitle = "Check User Read+Write Access for an Item"
    InfoDescription = "Report for identifying if a user has Read and Write access to a specific item."
    PageSize = 100

Get-Items | Show-ListView @props -Property @{ Label = "User Name"; Expression = { $_ } }


enter image description here

  • There are some ACL commands for checking and assigning security. Commented Nov 21, 2018 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.