User added to Team Project have no permission after upgrade from TFS2010 to TFS2013

I’ve performed an upgrade from TFS2010 to TFS2013 at a customer site last week. The upgrade consisted in moving to a different machine and from a Workstation to an Active Directory Domain. The operation was simple, because the customer uses only Source Control and they want to spent minimal time in the operation, so we decided for this strategy

  1. Stop TFS in the old machine
  2. Backup and restore db in the new machine
  3. Upgrade and verify that everything works correctly

They do not care about user remapping, or reporting services or other stuff, they just want to do a quick  migration to new version to use local workspaces new feature (introduced with TFS 2012). The do not care to remap old user to new user, they only care not to spend too much time in the upgrade.

The upgrade went smoothly, but we start facing a couple of problem. The first one is: after the migration, each team project has no user, because the machine is now joined to a domain with different users, but if we add users to a team project, they are not able to connect to team project, and they seems to have no permission. All the users that are Project collection Administrators can use TFS with no problem.

The reason is simple, in TFS2012 the concept of Teams was introduced in the product. Each Team Project can have multiple Teams and when you add users from the home page of the Team, you are actually adding people to a TFS Group that correspond to that Team. For each Team Project a default Team with the same name of the Team Project is automatically created.


Figure 1: Users added to Team through home page.

In the above picture, I’ve added two user to the BuildExperiments Team, we can verify this in the Settings page of the Team Project.


Figure 2: User added through the home page, are added to the corresponding Tfs Security Group

To understand the permission of that users, you should use the administration section of TFS, as you can see from Figure 3, BuildExperiments team has no permission associated.


Figure 3: Permission associated to the Team Group

The reason for this is: the Team is not part of the Contributors TFS Group, it can be verified from the Member Of part of group properties


Figure 4: Team group belongs only to the Project Valid User

When you create a new Team Project, the default team (with the same name of the Team Project) is automatically added to the Contributors group, it is that team that gives user the right to access the Team Project. To fix the above problem you can manually add the Team Tfs Group to the Contributors group using the Join Group button. Once the Team group is added to the Contributors group, all the people you add with web interface are now able to access the Team Project.

This behavior is the standard in TFS, if you create a new Team, the Ui suggests you to choose to add the new Team Group to an existing group to inherit permission.


Team 5: Default option for a new group is to be part of the Contributors group.

This is an optional choice, you can choose a different security group or you can choose no group, but you should then remember to explicitly add permission to the corresponding Team Group.

When people does not access TFS and you believe that they should, always double check all the groups they belong and the effective permissions associated to them.

Gian Maria.

If you need Tfs Hosting you can consider Azure

Yes, as Brian Harry announced some months ago, TFS on Azure will be a reality, actually there is a platform preview here, but it is actually closed, so you need to wait to have your TFS on Azure, but if you are planning to move on TFS and you’d like to use an hosted version of TFS this could be really a good option.

If you could not wait to have your hosted TFS server, this is another useful link that contains various offers made by different companies.


New Video card are only for gamers?… maybe

Maybe I’m the only person that have this opinion, but frankly speaking I was impressed on how bad my new video card performs on my new system. In this system I have 2 ATI Radeon HD4600, while in the old system I have two old X1550 video card, so I did not expect that dramatic loss of desktop graphics experience.

I need to confess you that desktop experience was really better with older cards. I extensively use snagit to capture screen, and with my new system I could use it only with aero disabled, because if I try to capture screen with aero enabled, the cursor of snagit move at one frame each two seconds, making impossible to select the area to capture.

When I first open Youtube to watch a video Flash shows a green video, then it blocks. After a quick search on the internet many people suggest to disable video card hardware acceleration, and this indeed solved the problem. Watching video with media player is impossible because the reproduction is crappy. When I switch Zune player from minimized version to maximized version it needs 5 seconds to show me something.

I tried to expose my problem in some forums, but people only told me that my cards are not so good for video gaming… come on… I do not care about video game performance, I want to be able to Work on my new system. watch a video of NDC, using snagit, etc, as I did on my old system.

My consideration is that video card manufacturer release TONS of new video card, but they care only about performance in gaming, so they do not care if card is Crappy on desktop experience. I have 2 video card because I use three monitor, and in a forum a user asked me “Why you have two video card without crossfire enabled, it is useless”, this happens because noone cares about performance of video cards outside FPS you got in some Shoot’em up game.

Now I’m working with Windows Aero disabled, I do not really care about this, because I do not need aero to work, but I’m very disappointed with ATI for these crappy video card I’ve bought :).

Another horrible feature is the HyperMemory, I really warn you to buy these CRAPPY ATI CARD if you do not care about gaming, Ati Catalyst told me that video card actually has 8GB of Hyper Memory. I’ve looked in a lot of forum and some people complain about ATI Cards to use system memory. Everyone tells “Video card use the memory only when it need to” but looking at how bad it performs on desktop experience I’m not sure if it is actually sucking me 8 gb of ram. And … surprise, there is no way to disable hyper memory, or reduce the amount of ram used. It seems impossible to me that ATI did not think to gave the user the possibility to set this value, so if video card driver are buggy it is possible that video card sucks 8GB of ram in my system……

Seriously, I’ll never buy an ATI card in the future, and probably I’ll throw these my new card in the rubbish and go for a couple of Matrox cards :).


Changing language specification is a risky business

Sometimes I heard people crying to have new features in languages like C#, and sometimes they believe that adding this and that feature is simple for a team working on language compiler. I want to remember to everyone how risky and delicate process is to change language specification.

I installed the Async CTP refresh on a production machine, and I discovered that some of my project now fails to compile, simply because I used the token async as function parameter name, and now it is a reserved keyword. This demonstrates that even adding a new reserved word can break existing code, and creating pain for the users of the language. Thus even small language modification should be heavily tested and considered before adding anything to a widespread language such as C#. I know that we, as programmers, love new cool addition to languages, but probably we should have the patient to wait a little bit Winking smile just to be sure that all ramification of an addition is considered.