Hello,
I'm looking for a way to extract a list of users have admin rights on the vault. I didn't find an option for it when Exporting the list of users from M-Files admin.
Thanks.
If you can't use the user group approach as suggested by Jan, here's a PowerShell script that may be useful. Replace the vault GUID on line 9 and comment / uncomment other lines as needed.
# Initialize PowerShell for M-Files
[Reflection.Assembly]::LoadWithPartialName( "Interop.MFilesAPI" )
$mfserver = new-object MFilesAPI.MFilesServerApplicationClass
# Connect to server
$mfserver.Connect(1) 
## UNCOMMENT THIS FOR SERVER USERS
#$users = $mfserver.LoginAccountOperations.GetLoginAccounts()
## UNCOMMENT THESE FOR VAULT USERS
$vault = $mfserver.LogInToVault("{6113C44B-8D6C-4243-ABCA-DAF32A02C786}")
## UNCOMMENT THIS TO GET VAULT USERS
$users = $vault.UserOperations.GetUserAccounts();
## UNCOMMENT THIS TO GET VAULT LOGINS (if vault level login accounts are in use)
#$users = $vault.UserOperations.GetLoginAccounts();
foreach ($user in $users) {
    ## VAULT ROLES
    ## 0    None.
    ## 1    Full control of vault.
    ## 2    Can log into the vault.
    ## 4    Can create documents or other objects.
    ## 8    See and read all vault content (including deleted objects).
    ## 16   See and undelete deleted objects.
    ## 32   Destroy objects.
    ## 64   Force undo checkout.
    ## 128  Change permissions for all objects.
    ## 256  Change metadata structure.
    ## 512  Manage user accounts.
    ## 1024 Internal user (as opposed to external user).
    ## 2048 Can create and modify traditional folders.
    ## 3078 The default vault roles for a normal user.
    ## 4096 Manage templates (obsolete).
    ## 8192 Manage common views and notification rules.
    ## 16384    Manage workflows.
    ## 32768    Cannot manage private views and notification rules.
    ## 65536    Anonymous user.
    ## UNCOMMENT THESE TO CHECK VAULT LEVEL ROLES
    ## Change "-band 1" part to wanted shown level. Default shows People with Full control -access
    if( $user.VaultRoles -band 1) {  
        Write-Output $user.LoginName $user.VaultRoles 
    }
    ## SERVER ROLES 
    ## 1 = Server Admin
    ## 2 = Vault creator
    ## 4 = Backup Operator
    ## 8 = Allows login to the server
    ##
    ## UNCOMMENT THESE TO CHECK SERVER LEVEL ROLES
    ##if( $user.ServerRoles -band 1) {  
    ##    Write-Output $user.AccountName $user.ServerRoles 
    ##}
    
    ## LICENSE TYPES
    ## 1 = Named user license
    ## 2 = Concurrent user license
    ## 3 = Read-only license
    ## UNCOMMENT THIS TO GET USERS WITH CERTAIN LICENSE TYPE
    #if(($user.LicenseType -eq 1) ) {
    #    Write-Output $user.UserName $user.LicenseType
    ## UNCOMMENT THESE TO SET LICENSE TYPE
    #    $user.LicenseType = 3
    #    $mfserver.LoginAccountOperations.ModifyLoginAccount($user)
    #}
    
}Joonas, could you please enlighten us with a few details on how and where to run this script? 
At least a username and a password must be provided somehow. And a connection to the server must be available. 
I assume it must run on the M-Files server itself? 
And perhaps username and password should be provided as parameters when starting the script?
Sorry, I don't have any additional information. I only found this script on the Consulting Wiki, haven't tried using it myself. But I think you may be right that it's expected to be run on the server since no credentials are given, unless if can somehow use the pre-defined vault connections on your computer.
© 2025 M-Files, All Rights Reserved.