TFS 2008 Subfolder Permissions

Question

I am a TFSAdmin and when I have a TFS project in which a subfolder needs specific permissions to deny some users. So, I right click on the folder in question hit Properties, and click the Security tab.

There I select the Windows User or Group radio, then click Add. I put in the AD User that I want specific permissions for and hit Check Names. That resolves, so I click OK.

Next, I select the permissions to Allow or Deny below in the Permissions for list. I hit OK.

The permission are honored by TFS, this user no longer has PendChange permissions and I was expecting.

The odd thing is, I was expecting to be able to go back into the Security tab and see that User in the list of Users and Groups and see the current state. But the list is always empty. Not sure why, but the permissions are definitely being honored, I can re-add the user with different permissions and those are also honored.

Any ideas why the current users are not showing up in the Users and Groups list under the Security tab for a folder's properties?

I also used the tf permission $\... to see if there were any permissions but it always returns

There are no permissions set for this item (Inherit: Yes)

I see this error TF200035: An error occured when synchronizing the following Active Directory identity: Team Foundation Valid Users. Exception Message: Error in the application.

Answer 1

This could be a synchronization issue between TFS and AD, or the "TfsJobAgent" is going crazy, the steps to troubleshoot it is long so I'll just paste you a link to it here: http://nakedalm.com/active-directory-groups-not-syncing-with-team-foundation-server-2010/

If the above link did not help, I would suggest to use a third party tool to manage your security permissions on the server, it might be that VS is not reporting the applied permissions correctly.

This tool will control TFS, Reporting and SharePoint sites all at the same time: http://tfsadmin.codeplex.com/releases/view/57795

Hope this helps,