TFS User Added to Windows Group Unable to Login
In our Team Foundation Server environment we decided to have our TFS users in a local Windows group and have that group added to a Team Foundation Server group. After installing Team System Web Access I naturally had to grant some users access. As per our configuration, I promptly added the user to the local Windows group and expected the user to be able to login. Ideally, of course.
“TF50309: You do not have sufficient permissions to perform this operation.”. Great.
After checking everything, I remembered that TFS does not update its own cache straight away. That is what the Team Foundation Server Task Scheduler is for. But, I want to have access right now!
In that case, you have two choices to get it refreshed immediately:
- Remove the local Windows group from the TFS server group and re-add it. This will force the web services to refresh the cache with the new security configuration. Note: This might be a problem in a high traffic production environment.
- Recycle the TFS AppPool, found in Internet Information Services > Application Pools. This is the more acceptable way of forcing the refresh.
Team Foundation Server Editions
You may or might need to know that there are two released editions of Team Foundation Server 2008. The one version is the workgroup version and the other the full or standard edition. The workgroup edition is intended and limited to a small number of users; in this case, five users. Then, there is the standard or full version, which supports unlimited users, as well as the trial edition.
How do you know which version you have installed? Here is a post by Leon Meijer, that describes a way in which you can find out, by looking in the registry. The other is of course by looking at the TFS groups that are created during the installation in Team Foundation Server. If there is a group called SERVER\Team Foundation Licensed Users, then it implies the workgroup edition.
What do you do when you have the wrong edition installed? Microsoft saw that one coming, and provided an easy way to change it. This article on MSDN describes the upgrade from the workgroup edition to the standard edition.
If you want to upgrade from the trial edition, this article describes the process to follow.
Team System Web Access for Bug Tracking
If you are looking for a neat customizable bug tracking system that integrates smoothly with Team Foundation Server, then Team System Web Access is for you! What makes it very nice in particular is that there are no extra licensing costs to use this for bug tracking. The licensing scheme was extended to accommodate this specific scenario.
There is one caveat with this approach though. It is very easy to move outside the bounds of this licensing agreement and therefore Microsoft is planning a new power tool codenamed “TFS Bug Submission Portal Power Tool” that will ensure the proper use within the licensing framework.
From the link above the power tool will allow the user to create new work items, edit and view the work items created by the user. The user cannot see work items created by others, list, view, edit, or run work item queries nor can the user add, edit, or remove work item links (except attachments or hyperlinks), access documents, access reports, access source control or access team build.
Team Foundation Server Service Pack 1 with Visual Studio 2008
If you intend on rolling out the new Service Pack 1 for Team Foundation Server 2008, please note the following comment at the bottom of the page:
“… Additionally, if you plan to install this service pack on a server that has a client for Team Foundation also installed on it, you must install SP1 for Visual Studio 2008 on that server before you install SP1 for Team Foundation Server…”
If you do not install the service packs in this order, you will end up re-installing Team Foundation Server 2008! I learned this the hard way… Read the manual when it comes to the Team Foundation Server.
Rebuilding WMI Repository
After having a bit of a struggle with Service Pack 1 for Team Foundation Server 2008, I had to restore a previous installation of Team Foundation Server 2005. After restoring the server, which runs on Virtual Server 2005 R2 everything seemed fine. It was only when trying to upgrade Team Foundation Server 2005 to 2008 that I received an error complaining about the WMI provider for SQL Server 2005.
Trying to look into this issue, I opened the SQL Server Configuration Manager and then received the following error:
“Cannot connect to WMI provider. You do not have permission or the server is unreachable. Note that you can only manage SQL Server 2005 servers with SQL Server Configuration Manager.
Initialization failure [0x80041014]“
This is not pretty. I went to Google the issue and discovered this post. It seems like the WMI repository corrupted when I did the restore. Nice. So, I followed the instructions detailed in the post, but no luck. It still returned with the same error that I received in the beginning.
The WMI Repository was corrupt in its entirety. How do you rebuild the WMI Repository? Not so easy it seems. Lukcily there is post describing the whole process with a neat little batch file that will rebuild the WMI Repository for you, came in very handy.
Note: Execute the following commands from this directory: C:\Program Files\Microsoft SQL Server\90\Shared
Here is the batch file duplicated for convenience:
net stop winmgmt c: cd %systemroot%\system32\wbem rd /S /Q repository
regsvr32 /s %systemroot%\system32\scecli.dll regsvr32 /s %systemroot%\system32\userenv.dll
mofcomp cimwin32.mof mofcomp cimwin32.mfl mofcomp rsop.mof mofcomp rsop.mfl
for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s
for /f %%s in ('dir /b *.mof') do mofcomp %%s
for /f %%s in ('dir /b *.mfl') do mofcomp %%s
echo DONE pause
mofcomp sqlmgmproviderxpsp2up.mof
After performing the above steps, I rebooted the server and Team Foundation Server upgraded successfully.
by Sydney du Plooy
Essential Team Foundation Server Tools
When you deal with Team Foundation Server as an administrator, extra tools are always welcome. Below is a list and a short description of the (free!) tools that I have found invaluable:
Note: Most of these tools require Administrator rights and when used improperly may result in your TFS Server being broken beyond repair. Be careful and backup!
- TFS Permission Manager: Allows you to add or remove TFS group memberships, Reporting Services role memberships and SharePoint role memberships. Permissions can be set for server and project-level permissions as well as AreaPath and Source Control permissions. You can create new TFS users with permissions identical to those of specified existing user and save user permissions as a template and use it later to create new or update existing users.
- Team Foundation Sidekick: Very nice and handy utility to manage various aspects of the version control system in Team Foundation Server. It now includes a new sidekick called the permission sidekick. Other sidekicks include: Code Review Sidekick, Shelveset Sidekick, Labels Sidekick, History Sidekick, Status Sidekick and Workspace Sidekick. A must have tool!
- Team Foundation Server Power Tools: Handy little tools that improves the Team Foundation Server experience. These tools include: Command line tool (TFPT.EXE), Build Notification tool, TFS Best Practices Analyzer, Process Template Editor, Work Item Templates, Custom check-in policies, TFS Server Manager,
TFS Users tool and an Alert Editor. Note that the TFS Best Practices Analyzer has a dependency on the Windows Powershell. The Power Shell must be installed first. - TFS Admin: If the TFS Permission manager is to confusing to use, try out this tool. It supports adding, deleting, and modifying multiple user permissions from a TFS Team Project and apply them at the same time. It also identifies missing permissions from Sharepoint or SQL Reporting Services and corrects them. Bonus. Allows you to view a log of permission changes that have occured and defines what Sharepoint and SQL Reporting Services permissions should be automatically used when creating a new TFS user.
- TFS Build Manager: A utility to manage Team Foundation build types in an environment other than Visual Studio and allows builds to be stopped and deleted with a lot more ease than what it was in TFS2005.
Most of these tools have been updated to work with TFS2008. I hope that these tools will save you time and make the Team Foundation Server experience so much better!
Team Foundation Server Groups
After upgrading a virtual server installation of TFS2005 to TFS2008, I found myself locked out and unable to access the server from Team Explorer in VS.NET 2008. Bummer.
While trying to solve this issue, I discovered a few things about Team Foundation server groups.
- Groups that start with SERVER is not a local Windows group on the server. It is a built in TFS group, with pre-configured rights assigned to it.
- The SERVER\Team Foundation Licensed Users group is limited to five user accounts. You cannot add Windows groups to this account.
- The SERVER\Team Foundation Valid Users group is automatically populated by TFS as users and groups are added to the security configuration. You cannot modify this group.
- SERVER\Team Foundation Administrators includes the BUILTIN\Administrators group from the local Windows installation by default. So, to add new administrators to the TFS server, either include them into the local Windows Administrators group, or create a new local group called TFS Administrators and add this group to the SERVER\Team Foundation Administrators group.
- To add users to Team Foundation server, you need to add either Windows groups or Windows users to the Project\Contributors group. If you want to give a user access to all Team Projects then add the user to the SERVER\Contributors group.
The reason I found myself locked out was because I restored the Team Foundation databases from another server. The server I restored from had the contributors group mapped to a Windows group, which did not exist on the new server.
While trying out various configurations, the following error popped up when I added a local Windows group to the SERVER\Team Foundation Licensed Users group:
This is about as descriptive as it gets. The error should have read “The local Windows group ‘Team Foundation Licensed Users’ group cannot be added to the TFS Team Foundation Licensed Users group. You may only add upto 5 users to this group.”.
You can find more information on Team Foundation Server Default Groups, Permissions, and Roles in this article.
leave a comment