I finally have this sorted. After my previous email I did some digging
around and ended up with the following query. It showed me that the user
had GENERIC_WRITE on the class ITERATION_NODE. These permissions did not
appear in the TFS Side Kick utility or in TFSSecurity.exe (unless I
missed them?). Locating and removing the permissions from the iterations
section in team explorer also removed the user from the 'Team Foundation
Valid Users' group.
select *
from TfsIntegration.dbo.tbl_security_acls as acls
join TfsIntegration.dbo.tbl_security_objects as obj
on acls.[oid] = obj.[oid]
left join TfsIntegration.dbo.tbl_security_actions as actions
on actions.[action_id] = acls.[action_id]
and actions.[class_id] = obj.[class_id]
where acls.sid = '<SID>'
and acls.deleted = 0
The error has not occurred again but I will keep an eye on it over the
next few days. If it occurs again, I have tracing turned on for
additional info.
From: [email protected] [mailto:[email protected]] On Behalf Of Tim Schmidt
Sent: Tuesday, 2 June 2009 10:10 AM
To: [email protected]
Subject: RE: TF200035: Synchronize with the following Active Directory
identity: Team Foundation Valid Users
That was interesting. In short the TFSUsers tool did not fix the
problem. It did help identify that a work item query existed with that
specific user as a value.
The help doco for TFSUsers.exe states that IIS should be stopped before
running the tool and then started after it has run. That's interesting
given that the tool reports "Error : Unable to connect to the remote
server" if IIS is stopped.
Since my original email, errors have occurred on the following dates:
* 30th May 8:43AM
* 29th May 3:42AM
* 25th May 12:28PM
* 23rd May 4:19AM
I'm a confused how the synchronisation, which occurs every hour, will
only fail every now and then. Is the synchronisation performing
different tasks each time it runs?
As far as I can tell, the user should not be showing in the "Team
Foundation Valid Users" group but still does.
Any thoughts would be appreciated.
Regards,
Tim Schmidt
Data Aspects Pty Ltd
From: [email protected] [mailto:[email protected]] On Behalf Of Tim Schmidt
Sent: Friday, 22 May 2009 1:41 PM
To: [email protected]
Subject: RE: TF200035: Synchronize with the following Active Directory
identity: Team Foundation Valid Users
Thanks Dylan. I will try that and report back.
From: [email protected] [mailto:[email protected]] On Behalf Of Dylan Tusler
Sent: Friday, 22 May 2009 12:00 PM
To: [email protected]
Subject: RE: TF200035: Synchronize with the following Active Directory
identity: Team Foundation Valid Users
There is some tool in the TFS Power Tools that is supposed to help with
this.
See
User Display Name Change (TFSUsers) Tool
<file:///C:\Program%20Files\Microsoft%20Team%20Foundation%20Server%20200
8%20Power%20Tools\Help\TFUsersCommandLineTool.mht>
in the help file installed with the tools.
Dylan.
________________________________
From: [email protected] [mailto:[email protected]] On Behalf Of Tim Schmidt
Sent: Friday, 22 May 2009 11:42 AM
To: [email protected]
Subject: TF200035: Synchronize with the following Active Directory
identity: Team Foundation Valid Users
Hi,
Our TFS server is reporting the following error:
TF53010: The following error has occurred in a Team Foundation component
or extension:
Date (UTC): 21/05/2009 1:19:41 PM
Machine: <Server>
Assembly: Microsoft.TeamFoundation.Server, Version=9.0.0.0,
Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a; v2.0.50727
Detailed Message: TF200035: One or more errors occurred when Team
Foundation Server attempted to synchronize with the following Active
Directory identity: Team Foundation Valid Users. Number of errors that
occurred: 1.
An error occurred when synchronizing the following Active Directory
identity: Team Foundation Valid Users. Exception message: Error in the
application..
When viewing the membership of "Team Foundation Valid Users", I can see
one account which should not be listed there. This is the one I am
assuming has the problem. The domain user account in question is
disabled and recently had its Display Name changed if this has any
impact?
I have used the Attrice TF Side Kicks application (v2.2) to determine if
any specific permissions, alerts etc are still assigned to this user.
The user did have work items assigned and specific security granted on
project areas. This has since been changed but the error remains.
The error appears to occur every second day or so. This seems a little
strange given that I have read that accounts are synchronised every hour
by default. The TFS Server Manager shows that the error has occurred on
the following dates:
* 21st May
* 18th May
* 17th May
* 15th May
* 9th May
Running "tfssecurity /server:<server name> /imx <domain\user>" returns
valid information and shows that the user is a member of only 1 group:
"e [A] [SERVER]\Team Foundation Valid Users".
I came across similar sounding posts here but they have not helped:
http://social.msdn.microsoft.com/Forums/en-US/tfsadmin/thread/6e5af2ab-1
cbc-4d12-9078-454147926316
http://social.msdn.microsoft.com/Forums/en-US/tfssetup/thread/39e766cb-a
8bd-4a55-a5b7-cfe360aeeda9
http://social.msdn.microsoft.com/Forums/en-US/tfsgeneral/thread/9be6715e
-cc29-401a-894e-3c22d385ed66
We are running TFS 2008 SP1. Any help would be appreciated.
Regards,
Tim Schmidt
Data Aspects Pty Ltd
________________________________
Support procedure: https://www.codify.com/lists/support
List address: [email protected] <mailto:[email protected]>
Subscribe: [email protected] <mailto:[email protected]>
Unsubscribe: [email protected]
<mailto:[email protected]>
List FAQ: http://www.codify.com/lists/oztfs
<http://www.codify.com/lists/oztfs>
Other lists you might want to join: http://www.codify.com/lists
<http://www.codify.com/lists>
************************************************************************
******************
To find out more about the Sunshine Coast Council, visit your local
council office at Caloundra, Maroochydore, Nambour or Tewantin. Or, if
you prefer, visit us on line at www.sunshinecoast.qld.gov.au
This email, together with any attachments, is intended for the named
recipient(s) only. Any form of review, disclosure, modification,
distribution and or publication of this email message is prohibited
without the express permission of the author. Please notify the sender
immediately if you have received this e-mail by mistake and delete it
from your system. Unless otherwise stated, this email represents only
the views of the sender and not the views of the Sunshine Coast Regional
Council.
************************************************************************
*******************
mail5.2.13
________________________________
Support procedure: https://www.codify.com/lists/support
List address: [email protected] <mailto:[email protected]>
Subscribe: [email protected] <mailto:[email protected]>
Unsubscribe: [email protected]
<mailto:[email protected]>
List FAQ: http://www.codify.com/lists/oztfs
<http://www.codify.com/lists/oztfs>
Other lists you might want to join: http://www.codify.com/lists
<http://www.codify.com/lists>
________________________________
Support procedure: https://www.codify.com/lists/support
List address: [email protected] <mailto:[email protected]>
Subscribe: [email protected] <mailto:[email protected]>
Unsubscribe: [email protected]
<mailto:[email protected]>
List FAQ: http://www.codify.com/lists/oztfs
<http://www.codify.com/lists/oztfs>
Other lists you might want to join: http://www.codify.com/lists
<http://www.codify.com/lists>
________________________________
Support procedure: https://www.codify.com/lists/support
List address: [email protected] <mailto:[email protected]>
Subscribe: [email protected] <mailto:[email protected]>
Unsubscribe: [email protected]
<mailto:[email protected]>
List FAQ: http://www.codify.com/lists/oztfs
<http://www.codify.com/lists/oztfs>
Other lists you might want to join: http://www.codify.com/lists
<http://www.codify.com/lists>
--------------------------------------------------------------------------------
Support procedure: https://www.codify.com/lists/support
List address: [email protected]
Subscribe: [email protected]
Unsubscribe: [email protected]
List FAQ: http://www.codify.com/lists/oztfs
Other lists you might want to join: http://www.codify.com/lists
