locked
Need to Be a Member of "Service Accounts Group" RRS feed

  • Question

  • I am trying to get started using TFS Integration and I have created 2 dummy TFS 2010 projects.  One that is empty (B) and one that is not (A).  I am migrating from A to B.

    When I run I get the following runtime conflict twice:

    Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.PermissionException: TFS WIT bypass-rule submission is enabled. However, the migration service account 'Schaff, Stephen' is not in the Service Accounts Group on server 'http://tfs2010test:8080/tfs/sqa'.
       at Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.TfsCore.CheckBypassRulePermission()
       at Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.TfsWITMigrationProvider.InitializeTfsClient()
       at Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.TfsWITMigrationProvider.InitializeClient()
       at Microsoft.TeamFoundation.Migration.Toolkit.MigrationEngine.Initialize(Int32 sessionRunId)

    I tried to add me to the Service Account Group for my TFS Collection\server but I cannot (it is grayed out for some reason).

    I am getting the feeling I am off base.  I installed this TFS Server and have full administrator rights.  There should not be anything I can't do right?

    What am I missing?

    ___________

    NOTE: I saw this link: http://blogs.msdn.com/b/willy-peter_schaub/archive/2009/11/10/tfs-integration-platform-what-is-the-enablebypassruledatasubmission-in-the-configuration-file-question-answer-7.aspx

    Which seems to think that running the following will fix this issue:

    1: cd "C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE>"

    2: tfssecurity /g+ srv: tfs2010b1x32t\Administrator /server:tfs2010b1x32t\defaultcollection

    3: pause

     

    I tried that (using my server) and I got this:

     C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE>tfssecurity /g+ srv: tfs2010test\Administrator /server:http://tfs2010test:8080/tfs/sqa
     TFSSecurity - Team Foundation Server Security Tool
     Copyright (c) Microsoft Corporation. All rights reserved.
     The target Team Foundation Server is http://tfs2010test:8080/tfs/sqa.
     Team Foundation services are not available from server http://tfs2010test:8080/tfs/sqa.
     Technical information (for administrator):
     HTTP code 404: Not Found
    
    
    Tuesday, August 24, 2010 10:03 PM

Answers

  • Wow! This one was hard to figure out.  In the end I only got it due to luck (and trying a lot of different things).

    Here is what you do:

    1. Open the TFS Admin Console
    2. Click on the Applciation Tier in the left tree
    3. In the "Administration Console Users"  find your user (assuming it is there)
    4. Select your user, and then select "Reapply" to the right of the box
    5. Click on Advanced Features in the dialog box that appears.
    6. Make sure "Add required permissions to change service accounts" is selected.
    7. Select OK
    8. RESULT: The user is added to the "Team Foundation Service Accounts" group
    whew!  Glad that is solved, I was going NUTS!
    • Marked as answer by Vaccanoll Wednesday, August 25, 2010 6:46 PM
    Wednesday, August 25, 2010 5:17 PM
  • Wow! This one was hard to figure out.  In the end I only got it due to luck (and trying a lot of different things).

    Here is what you do:

    1. Open the TFS Admin Console
    2. Click on the Applciation Tier in the left tree
    3. In the "Administration Console Users"  find your user (assuming it is there)
    4. Select your user, and then select "Reapply" to the right of the box
    5. Click on Advanced Features in the dialog box that appears.
    6. Make sure "Add required permissions to change service accounts" is selected.
    7. Select OK
    8. RESULT: The user is added to the "Team Foundation Service Accounts" group
    whew!  Glad that is solved, I was going NUTS!

    In TFS 2012 this doesn't work anymore. You will need to use the tfssecurity option: TFSSecurity.exe /g+ "Team Foundation Service Accounts" n:USERNAME
    /server:SERVERNAME

    • Marked as answer by Vaccanoll Wednesday, June 27, 2012 11:03 PM
    Wednesday, June 27, 2012 9:34 PM
  • Thank you!

    I am glad I've found this post. I was going nuts too :)

    And for the record, in TFS 2008, the syntax is:

    TFSSecurity.exe /server:<YOUR TFS SERVER NAME> /g+ "[Server]\Service Accounts" n:"<Your Windows Domain Name>\<Your service account name>"

     

    • Marked as answer by Vaccanoll Friday, January 28, 2011 12:38 AM
    Wednesday, October 20, 2010 3:25 PM

All replies

  • Wow! This one was hard to figure out.  In the end I only got it due to luck (and trying a lot of different things).

    Here is what you do:

    1. Open the TFS Admin Console
    2. Click on the Applciation Tier in the left tree
    3. In the "Administration Console Users"  find your user (assuming it is there)
    4. Select your user, and then select "Reapply" to the right of the box
    5. Click on Advanced Features in the dialog box that appears.
    6. Make sure "Add required permissions to change service accounts" is selected.
    7. Select OK
    8. RESULT: The user is added to the "Team Foundation Service Accounts" group
    whew!  Glad that is solved, I was going NUTS!
    • Marked as answer by Vaccanoll Wednesday, August 25, 2010 6:46 PM
    Wednesday, August 25, 2010 5:17 PM
  • Thank you!

    I am glad I've found this post. I was going nuts too :)

    And for the record, in TFS 2008, the syntax is:

    TFSSecurity.exe /server:<YOUR TFS SERVER NAME> /g+ "[Server]\Service Accounts" n:"<Your Windows Domain Name>\<Your service account name>"

     

    • Marked as answer by Vaccanoll Friday, January 28, 2011 12:38 AM
    Wednesday, October 20, 2010 3:25 PM
  • Wow! This one was hard to figure out.  In the end I only got it due to luck (and trying a lot of different things).

    Here is what you do:

    1. Open the TFS Admin Console
    2. Click on the Applciation Tier in the left tree
    3. In the "Administration Console Users"  find your user (assuming it is there)
    4. Select your user, and then select "Reapply" to the right of the box
    5. Click on Advanced Features in the dialog box that appears.
    6. Make sure "Add required permissions to change service accounts" is selected.
    7. Select OK
    8. RESULT: The user is added to the "Team Foundation Service Accounts" group
    whew!  Glad that is solved, I was going NUTS!

    In TFS 2012 this doesn't work anymore. You will need to use the tfssecurity option: TFSSecurity.exe /g+ "Team Foundation Service Accounts" n:USERNAME
    /server:SERVERNAME

    • Marked as answer by Vaccanoll Wednesday, June 27, 2012 11:03 PM
    Wednesday, June 27, 2012 9:34 PM