patterns & practices: Team System Community Guidance

NEW POST: Generic Test in VS2005

babushan — Thu, 05 Jul 2007 15:50:51 GMT

I was trying to create a generic test project as quoted in the below example.
http://msdn2.microsoft.com/en-us/library/ms182626(VS.80).aspx

I am unable to proceed after creating the test project.

" Right-click the test project, point to Add, and then click Generic Test."

When i tried to add the Generic Test, it is not appearing in the Context Menu.

I assume this template is not installed in my IDE. I tried searching and i was unable to locate that.

Any Suggestions?

UPDATED WIKI: Home

mycodeplexuser — Sun, 03 Jun 2007 23:41:11 GMT

patterns & practices Community Wiki for Team System

Welcome to the patterns & practices Community Wiki for Team System! This is an experiment to see what a little harnessed community power can do. This is a partner site of the patterns & practices Visual Studio Team System Guidance Project. - J.D. Meier, Jason Taylor, Prashant Bansode

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: Home

mycodeplexuser — Sun, 03 Jun 2007 23:40:32 GMT

patterns & practices Community Wiki for Team System

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: Home

mycodeplexuser — Sun, 03 Jun 2007 23:40:10 GMT

patterns & practices Community Wiki for Team System

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: Home

mycodeplexuser — Sun, 03 Jun 2007 23:39:55 GMT

patterns & practices Community Wiki for Team System

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

<!--

Resource Lists

These are indexes of resources the Team System community uses.

-->

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: VSS to Team System Migration Checklist

llangleyben — Sun, 03 Jun 2007 22:38:58 GMT

VSS to Team System Migration Checklist

By Leon Langleyben

Introduction

Migration of VSS database into Team System is multistage process. You can find documentation for each part in MSDN. Here I would like to combine it into single checklist and complete with some our additions and clarifications.

Prerequisites

Visual Source Safe 2005. Note: It is not included with VSTS installation or with VS2005. VSS2005 client is compatible with VSS6 database, you can install it safely.
VSSConverter.exe utility. Installed with Team Explorer. It is located usually in C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\
List of users for Team System. You will need user names including domain as it defined in AD
Team Explorer – should be installed on each TS client.

We advise to run migration on TF server machine. In this case you need to insure all 3 utilities installed there.

SQL Server Express (if you are not performing migration on server machine) – Installed by default with Visual Studio 2005.

Preparations

Make sure you have VSS administrator user/password and TS Project Administrator user/password.
Ask your team members to check in their files and disconnect from VSS (make sure they close IDE and VSS explorer). Updated checked out file versions will not be migrated into VSTS. If you absolutely can not check in, back it up and check in directly into VSTS after migration. Use VSS Admin tool to monitor logged in users. Use VSS Explorer to find checked out files (View>Search>Status Search).
Copy your VSS database. By performing this action you will achieve two goals:

VSS backup. Backup is important because VSS Analyze operation is potentially dangerous, it can (and without backup, according to Murphy's Law, definitely will) effectively destroy your database.
Copying database to TFS machine will allow migration process to run locally. Migration is a very heavy operation, running it locally will greatly speed up the whole process.

Prepare Team Foundation Project. To perform migration you need Team Project with source control repository. Add users to appropriate project groups. To associate files' revisions with actual users you will need to map those users to VSS users.
Decide which VSS folders you would like to migrate and what will be your source tree structure in TFS. Many organizations use migration process as a convenient opportunity to rethink the project structure. If you are planning to do it, we strongly suggest you reconsider. a better idea is to migrate sources as is, check new source control validity and then restructure your projects. This approach is much safer.

Analyze Stage

At this stage VSS database analyzed for potential problems, and attempts made to fix as many problems as possible. Run Analyze.exe utility on VSS database (copied on the previous stage). We suggest using it with analyze –fp –v4 options. Make sure that the backup directory, located inside the data directory of VSS, is empty before you are running the tool. You can safely empty backup directory if it contain files. See http://msdn2.microsoft.com/en-us/library/ysxsfw4x.aspx for complete description of analyze.exe utility.

Migration Stage. Finally: Converting…

At this stage you should run VSSConverter.exe utility twice. First time to check VSS database for potential data loses and retrieve list of VSS Users. There is some information that can not be preserved in process of migration. To summarize, VSS Sharing, Branching and Pinning are not supported in Team System (implemented differently). See complete list of limitation here. The VSSConverter utility accepts an xml configuration file as parameter. You should specify in the configuration location of VSS database and VSS project path for each project you want to migrate. See attached analyze configuration file sample.
Note:
Use "$/" to analyze/migrate complete VSS database.
Using "$" without "/" will cause VSSConverter to hang.

Run VSSConverter analyze <configuration file name> .
You’ll need to provide the VSS admin password when prompted.
Have some coffee…

After the stage is finished, the utility produces UserMapping.xml file containing a list of all VSS users that performed at least one operation on the VSS database. Complete the mapping file with TFS user names. You’ll need to specify user names including the domain (MyDomain\MyUserName).
Check list of expected data losses in VSSMigrationReport.
Specify in configuration file Team Foundation Server name and port (8080 by default), and Destination path for each project being migrated. See migration configuration file sample.

Run VSSConverter migrate <configuration file name> .
Confirm migration and supply VSS admin password.
Go to see a long movie… Expect migration to take hours, 5 to 10 times longer then analyze.
Congratulations, you are done!
Connect your IDE to TFS and enjoy the ride.

Summary

Migration works for us smooth and easy, as long as we performing it step by step according to this checklist. Use it and let us know about any additions or problems you encounter.

Resources

You can download archive which contains following files:

VSSAnalyze.bat - Analyze VSS database
analyze.bat - Execute VSSConvert.exe analyze
migrate.bat - Execute VSSConvert.exe migrate
VssSetting_Analyze.xml - Sample configuration for analyze
VssSetting_Migration.xml - Sample configuration for migration
UserMap.xml - Sample user mapping file

Sample configuration files asume that both Team Explorer and VSS installed in default directory, VSS database located at "C:\Migration\SourceSafe" (location of srcsafe.ini), The whole VSS database being migrated (<PROJECT Source="$/"></PROJECT>), destination root project path in Team System is "$/Common", TF Server name is teamsys and port 8080.

Original article was published at our team blog

UPDATED WIKI: VSS to Team System Migration Checklist

llangleyben — Sun, 03 Jun 2007 22:38:18 GMT

VSS to Team System Migration Checklist

By Leon Langleyben

Introduction

Prerequisites

Visual Source Safe 2005. Note: It is not included with VSTS installation or with VS2005. VSS2005 client is compatible with VSS6 database, you can install it safely.
VSSConverter.exe utility. Installed with Team Explorer. It is located usually in C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\
List of users for Team System. You will need user names including domain as it defined in AD
Team Explorer – should be installed on each TS client.

We advise to run migration on TF server machine. In this case you need to insure all 3 utilities installed there.

SQL Server Express (if you are not performing migration on server machine) – Installed by default with Visual Studio 2005.

Preparations

Make sure you have VSS administrator user/password and TS Project Administrator user/password.
Ask your team members to check in their files and disconnect from VSS (make sure they close IDE and VSS explorer). Updated checked out file versions will not be migrated into VSTS. If you absolutely can not check in, back it up and check in directly into VSTS after migration. Use VSS Admin tool to monitor logged in users. Use VSS Explorer to find checked out files (View>Search>Status Search).
Copy your VSS database. By performing this action you will achieve two goals:

VSS backup. Backup is important because VSS Analyze operation is potentially dangerous, it can (and without backup, according to Murphy's Law, definitely will) effectively destroy your database.
Copying database to TFS machine will allow migration process to run locally. Migration is a very heavy operation, running it locally will greatly speed up the whole process.

Prepare Team Foundation Project. To perform migration you need Team Project with source control repository. Add users to appropriate project groups. To associate files' revisions with actual users you will need to map those users to VSS users.
Decide which VSS folders you would like to migrate and what will be your source tree structure in TFS. Many organizations use migration process as a convenient opportunity to rethink the project structure. If you are planning to do it, we strongly suggest you reconsider. a better idea is to migrate sources as is, check new source control validity and then restructure your projects. This approach is much safer.

Analyze Stage

Migration Stage. Finally: Converting…

Summary

Migration works for us smooth and easy, as long as we performing it step by step according to this checklist. Use it and let us know about any additions or problems you encounter.

Resources

You can download archive which contains following files:

VSSAnalyze.bat - Analyze VSS database
analyze.bat - Execute VSSConvert.exe analyze
migrate.bat - Execute VSSConvert.exe migrate
VssSetting_Analyze.xml - Sample configuration for analyze
VssSetting_Migration.xml - Sample configuration for migration
UserMap.xml - Sample user mapping file

UPDATED WIKI: VSS to Team System Migration Checklist

llangleyben — Sun, 03 Jun 2007 22:35:30 GMT

VSS to Team System Migration Checklist

By Leon Langleyben

Introduction

Prerequisites

Visual Source Safe 2005. Note: It is not included with VSTS installation or with VS2005. VSS2005 client is compatible with VSS6 database, you can install it safely.
VSSConverter.exe utility. Installed with Team Explorer. It is located usually in C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\
List of users for Team System. You will need user names including domain as it defined in AD
Team Explorer – should be installed on each TS client.

We advise to run migration on TF server machine. In this case you need to insure all 3 utilities installed there.

SQL Server Express (if you are not performing migration on server machine) – Installed by default with Visual Studio 2005.

Preparations

Make sure you have VSS administrator user/password and TS Project Administrator user/password.
Ask your team members to check in their files and disconnect from VSS (make sure they close IDE and VSS explorer). Updated checked out file versions will not be migrated into VSTS. If you absolutely can not check in, back it up and check in directly into VSTS after migration. Use VSS Admin tool to monitor logged in users. Use VSS Explorer to find checked out files (View>Search>Status Search).
Copy your VSS database. By performing this action you will achieve two goals:

VSS backup. Backup is important because VSS Analyze operation is potentially dangerous, it can (and without backup, according to Murphy's Law, definitely will) effectively destroy your database.
Copying database to TFS machine will allow migration process to run locally. Migration is a very heavy operation, running it locally will greatly speed up the whole process.

Prepare Team Foundation Project. To perform migration you need Team Project with source control repository. Add users to appropriate project groups. To associate files' revisions with actual users you will need to map those users to VSS users.
Decide which VSS folders you would like to migrate and what will be your source tree structure in TFS. Many organizations use migration process as a convenient opportunity to rethink the project structure. If you are planning to do it, we strongly suggest you reconsider. a better idea is to migrate sources as is, check new source control validity and then restructure your projects. This approach is much safer.

Analyze Stage

Migration Stage. Finally: Converting…

Summary

Migration works for us smooth and easy, as long as we performing it step by step according to this checklist. Use it and let us know about any additions or problems you encounter.

Resources

You can download archive which contains following files:

VSSAnalyze.bat - Analyze VSS database
analyze.bat - Execute VSSConvert.exe analyze
migrate.bat - Execute VSSConvert.exe migrate
VssSetting_Analyze.xml - Sample configuration for analyze
VssSetting_Migration.xml - Sample configuration for migration
UserMap.xml - Sample user mapping file

UPDATED WIKI: Home

alikl — Sun, 03 Jun 2007 18:38:33 GMT

patterns & practices Community Wiki for Team System

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

Resource Lists

These are indexes of resources the Team System community uses.

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: Home

mycodeplexuser — Thu, 17 May 2007 16:49:55 GMT

patterns & practices Community Wiki for Team System

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

Resource Lists

These are indexes of resources the Team System community uses.

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: Home

mycodeplexuser — Thu, 17 May 2007 16:49:32 GMT

patterns & practices Community Wiki for Team System

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

Resource Lists

These are indexes of resources out in the wild that the Team System community uses.

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: Home

mycodeplexuser — Thu, 17 May 2007 16:49:17 GMT

patterns & practices Community Wiki for Team System

Community Wiki Leads

Alik Levin, Leon Langleyben, Martin Woodward, Michael Ruminer, Sarit Tamir, Steven Borg

Articles

Resource Lists

These are indexes of resources out in the wild that the Team System community uses.

Templates and Examples

Use templates when creating content. Template help make the content easier to create, use and reuse. When in doubt, use a Technote.

Explained Template - use this for longer, conceptual and depth information.
How To Template - use How Tos for step by step instructions.
Technote Template - use Technotes for shorter, reusable nuggets of insight.
Scenario Frame Example - useful for framing out a problem space. Use them to see the bigger picture or to identify where more content is needed.

Related Projects

UPDATED WIKI: Setting Permissions in Team Foundation

llangleyben — Thu, 17 May 2007 12:05:45 GMT

Setting Permissions in Team Foundation

By Leon Langleyben

Applies To

Team Foundation Server

INTRODUCTION
BUILT-IN AND CUSTOM GROUPS

SERVER LEVEL GROUPS
PROJECT LEVEL GROUPS

PERMISSIONS IN TFS

SERVER-LEVEL PERMISSIONS

How to establish server-level permissions

PROJECT-LEVEL PERMISSIONS

How to establish project-level permissions

WORK ITEM TRACKING AREAPATH PERMISSIONS

How to establish AreaPath permissions

PORTAL - WINDOWS SHAREPOINT GROUPS
REPORTING SERVICES PERMISSION

Reporting Services Roles
Reporting Services Tasks (Permissions)
How to establish permissions in RS

SOURCE CONTROL SECURITY RIGHTS AND PERMISSIONS

How to establish source control permissions

TEAM BUILD PERMISSIONS

Build Permissions Types:

Setup a build
Build Service account permissions
Manage Build Type
Start a build
Delete a build
Stop a build
View a build report
Edit a build Quality
How to establish build permissions

RECOMMENDED PERMISSIONS

TFS ADMINISTRATOR
PROJECT LEAD
DEVELOPER (CONTRIBUTOR)
MANAGEMENT LEVEL, REFERENTS ETC.

UTILITIES

TFSSECURITY
TF
TFSADMIN
TFS Permission Manager

RESOURCES

Introduction

Handling security in TFS is quite complex and requires understating of the various parts of the platform pops-up a lot of questions. In this document we will go through most of security and permissions issues: Server and project groups, permissions granting in: source control, portal, reporting services, work item and team build. We will also recommend a mixture of permissions that match common roles. Finally, we will go over three permissions tools: tf, TFSecuriry and TFSAdmin.

Built-In and Custom Groups

The Security permissions in Team Foundation Server (TFS) are applicable both to individual users or groups of users. TFS is installed with a bunch of useful default security groups. The following tables summarize the permissions granted to these groups. It is possible and very simple, to add additional groups through the Team Explorer:

For Server Level group, right click the server node in Team Explorer and select Team Foundation Server Settings>Group Membership>New…
For Project Level group, right click project node in Team Explorer and select Team Project Settings>Group Membership>New…

Once you’ve created a group, you can start adding users (use the exact same method for adding users to built-in groups):

Add users through Team Explorer.
Add users through the TFSAdmin utility (for project level groups )

Granting specific TS permission to users or groups can be achieved using Team Explorer or one of these Microsoft Utilities: tf, TFSecuriry and TFSAdmin (follow the links for further information).
Note: Each one of the utilities deals with some of the permissions you will need to grant. Follow the reference to decide which one is better supporting your needs.

Server Level Groups

Group Name	Permissions	Description
SERVER\Team Foundation Administrators Administer Shelved Changes	Administer warehouse, Administer workspaces, Create a workspace, Create new projects, Edit Server-Level information, Alter Trace Settings, Trigger Events, Manage Process Template, View Server-level information, View system synchronization information, Full Area Path permissions for all nodes, Full Source Control Permissions	Members of this group can perform all operations for Team Foundation Server. This group should be restricted to the smallest possible number of users who need total administrative control over Team Foundation Server. By default, this group contains the Local Administrators group (BUILTIN\Administrators) for the server and the SERVER\Service Accounts group.
SERVER\Team Foundation Valid Users	Create a workspace, View Server-level information, Area Path permissions for all nodes: View this node, Source Control Permissions: Read	Members of this group have access to Team Foundation Server. This group automatically contains all users and groups that have been added anywhere within Team Foundation Server. You cannot modify the membership of this group.
SERVER\Service Accounts	Administer Shelved Changes, Administer warehouse, Administer workspaces, Trigger Events, View Server-level information, View system synchronization information	Members of this group have service-level permissions for Team Foundation Server. By default this group contains the service account supplied during installation. If you want to add new accounts to this group, you must add them using the TFSSecurity command-line tool. This group should only contain service accounts and not user accounts or groups (unless that group only contains service accounts). By default, this group is a member of Team Foundation Administrators.
SERVER\Team Foundation Licensed Users		Members of this group can connect to the server installed with Team Foundation Server Workgroup Edition. Access to the server is permitted to members and no other permissions are explicitly set for this group. The group can have one to five user accounts but no group accounts as members. The user accounts can be domain accounts or members of a workgroup environment. The term "workgroup" in the product name refers to a group of the one to five users and not the workgroup environment. Only members of this group can connect to the server. By default, the user account used to install Team Foundation Server Workgroup Edition becomes a member of this group.

Project Level Groups

Group Name	Permissions	Description
Project Name\Project Administrators	Administer a build, Delete this project, Edit build quality, Edit project-level information, Publish Test Results, Start a Build, View Project-level information, Full Area Path permissions for all nodes in project, Full Source Control Permissions for all source files and folders in project	Members of this group can administer all aspects of the team project, although they cannot create new projects.
Project Name\Contributors	Start a Build, View Project-level information, Area Path permissions for all nodes in project: Edit work items in this node, View this node, View work items in this node, Source Control Permissions: Read, Check out, Check in, Label, Lock	Members of this group can contribute to the project in multiple ways, such as add, modify, and delete code, create and modify work items, and so on.
Project Name\Readers	View Project-level information, Area Path permissions for all nodes in project: View work items in this node' Source Control Permissions: Read	Members of this group can view the project but not modify it.
Project Name\Build Services	Publish Test Results, Start a Build, View Project-level information, Write to Build Operational Store, Area Path permissions for all nodes in project: Edit work items in this node, View this node, View work items in this node, Source Control Permissions: Read, Check out, Check in, Label, Lock	Members of this group have build service permissions for the project. This group should only contain build service accounts and not user accounts or groups (unless that group only contains build service accounts).

Permissions in TFS

Setting permissions in TFS is not a straight forward task. The complexity stems for the fact that TFS is not an application; rather it is a platform, and a collection of applications and usability we should understand in depth, so we can successfully grant the suitable permissions. This chapter deals with the different parts, explains and recommends everything out there about permissions.

Server-Level permissions

Project-Level permissions
Work item tracking permissions
Portal permissions
Reporting services permissions
Source control permissions
Team Build permissions

Server-Level Permissions

Permission Name	Parameters used in the utilities	Description	Recommended only for internal use
Administer shelved changes	tf: AdminShelvesets	Users who have this permission can delete shelvesets created by other users.
Administer warehouse	TFSSecurity: ADMINISTER_WAREHOUSE	Users who have this permission can change warehouse settings by using the ChangeSetting Web method of the WarehouseController.asmx Web service. For example, you could allow users to set the update interval for calculating the OLAP cubes.
Administer workspaces	tf: AdminWorkspaces	Users who have this permission can create workspaces for other users and delete workspaces created by other users.
Create a workspace	tf: CreateWorkspace	Users who have this permission can create a source control workspace.	√
Create new projects	TFSSecurity: CREATE_PROJECTS	Users who have this permission can create new projects in Team Foundation Server. In order to successfully create new projects, these users must be a member of the SharePoint Central Admins group in Windows SharePoint Server and have Content Manager permissions in SQL Reporting Services.
Edit server-level information	TFSSecurity: GENERIC_WRITE, tf: AdminConfiguration, tf: AdminConnections	Users who have this permission can edit server-level permissions for users and groups on Team Foundation Server. They can add or remove server-level Team Foundation Server application groups from Team Foundation Server. When set through the menus, the Edit server-level information permission also implicitly allows the user to modify source control permissions. To grant all the above permissions from the command line, you must use the tf.exe Permission command to grant the AdminConfiguration and AdminConnections permissions as well as GENERICWRITE. Note: Default server groups such as Team Foundation Administrators cannot be removed.	√
Alter trace settings	TFSSecurity: DIAGNOSTIC_TRACE	Users who have this permission can change the trace settings for gathering more detailed diagnostic information about Team Foundation Server Web services.
Trigger Events	TFSSecurity: TRIGGER_EVENT	Users who have this permission can trigger project alert events within Team Foundation Server. This permission should only be assigned to service accounts.
Manage process template	TFSSecurity: MANAGE_TEMPLATE	Users who have this permission can download, create, edit, and upload process templates to Team Foundation Server.
View server-level information	TFSSecurity: GENERIC_READ	Users who have this permission can view server-level group membership and the permissions of those users.	√
View system synchronization information	TFSSecurity: SYNCHRONIZE_READ	Users who have this permission can trigger synchronization events. This permission should only be assigned to service accounts.	√

How to establish server-level permissions

In Team Explorer right click team server node, select Team Foundation Server Settings>Security… Add user and set permissions.
Use TFSSecurity tool

Project-Level Permissions

Permission Name	Parameter used in TFSSecurity	Description	Recommended only for internal use
Administer a build	ADMINISTER_BUILD	Users who have this permission can delete completed builds and stop current builds in progress.
Delete this project	DELETE	Users who have this permission can delete the project for which they have this permission from Team Foundation Server.	√
Edit build quality	EDIT__BUILD__STATUS	Users who have this permission can add information about the quality of the build through the Team Foundation Build user interface. This information is stored in the Team Foundation Build database store.
Edit project-level information	GENERIC_WRITE	Users who have this permission can edit project-level permissions for users and groups on Team Foundation Server.	√
Publish test results	PUBLISH__TEST__RESULTS	Users who have this permission can add and remove test results on the team project portal and add or remove test runs.
Start a build	START_BUILD	Users who have this permission can start a build through the Team Foundation Build user interface or from the command line.
View project-level information	GENERIC_READ	Users who have this permission can view project-level group membership and the permissions of those project users.
Write to build operational store	UPDATE_BUILD	This permission must be granted to the account under which the Build Service is running, in order to update the Team Foundation Build database store. This permission should only be assigned to service accounts and not to individual users.

How to establish project-level permissions

In Team Explorer right click team project node, select Team Project Settings>Security… Add user and set permissions.
Use TFSSecurity tool

Work Item Tracking AreaPath Permissions

Permission Name	Parameter used in TFSSecurity	Description	Recommended only for internal use
Create and order child nodes	CREATE_CHILDREN	Users who have this permission can create new area nodes. Users who have this permission and the Edit this node permission can move or re-order any child area nodes.	√
Delete this node	DELETE	Users who have both this permission and the Edit work items in this node permission for another node can delete area nodes and reclassify existing work items from the deleted node. Any child nodes of the deleted parent node are also deleted.
Edit this node	GENERIC_WRITE	Users who have this permission can rename area nodes.
Edit work items in this node	WORK__ITEM__WRITE	Users who have this permission can edit work items in this area node.
View this node	GENERIC_READ	Users who have this permission have access to view the security settings for this node.	√
View work items in this node	WORK__ITEM__READ	Users who have this permission can view, but not edit or change, work items in this area node.

How to establish AreaPath permissions

In Team Explorer right click team project node, select Areas and Iterations…, select Area node, click security… Add user and set permissions.
Use TFSSecurity tool

Portal - Windows SharePoint Groups

The WSS (Windows SharePoint Services) portal is used to contain the projects documents (requirement documents, design papers, excel charts, presentations, etc.). The following table lists the four types of users available in the portal. Note that members on the machine’s built-in administrators group get, by default, administrative rights on the portal.

Permission Name	Description
Reader	Has read-only access to the Web site
Contributor	Can add content to existing document libraries and lists
Web Designer	Can create lists and document libraries and customize pages in the Web site
Administrator	Has full control of the Web site

How to browse the portal:

Start Visual Studio and in Team Explorer, connect to a Team Foundation Server.
Right-click the team project node, and click Show Project Portal.

How to add users:

Click Site Settings, and then click Manage Users.
Click Add Users.
In Step 1: Choose Users; add the alias for the person to whom you want to grant site-wide administration permissions.
In Step 2: Choose Site Groups, select desired permissions.
Click Next.
In Step 3: Confirm Users; add the e-mail address of the user.
In Step 4: Send E-Mail; choose whether to automatically send the user an e-mail.
Click Finish.

To Change Users Permissions

Select one or more users
Click "Edit Site Groups of Selected Users"
Assign permissions
Press OK.

Reporting Services Permission

In Reporting Services, users are associated with predefined roles. Permissions (Reporting Services tasks) are granted to those roles. RS installed with some predefined roles, new roles can be created.

Reporting Services Roles

Built in Site Wide Roles

Role	Description
System Administrator	View and modify system role assignments, system role definitions, system properties, and shared schedules.
System User	View system properties and shared schedules.

Built in Project Level Roles

Role	RS Permissions	Description
Browser	Manage individual subscriptions, View folders, View models, View reports, View resources	May view folders, reports and subscribe to reports.
Content Manager	Full Permissions	May manage content in the Report Server. This includes folders, reports and resources.
My Reports	Create linked reports, Manage data sources, Manage folders, Manage individual subscriptions, Manage report history, Manage reports, Manage resources, View data sources, Manage individual subscriptions, View folders, View models, View reports, View resources	May publish reports and linked reports; manage folders, reports and resources in a users My Reports folder.
Publisher	Create linked reports, Manage data sources, Manage folders, Manage models, Manage reports, Manage resources	May publish reports and linked reports to the Report Server.
Report Builder	Consume reports, Manage individual subscriptions, View folders, View models, View reports, View resources	May view report definitions.

Reporting Services Tasks (Permissions)

RS Task	Description
Consume reports	Reads report definitions
Create linked reports	Create linked reports and publish them to a report server folder.
Manage all subscriptions	View, modify, and delete any subscription regardless of who owns the subscription.
Manage data sources	Create and delete shared data source items; and modify data source properties.
Manage folders	Create, view and delete folders; and view and modify folder properties.
Manage individual subscriptions	Each user can create, view, modify and delete subscriptions that he or she owns.
Manage models	Create, view, and delete models; and view and modify model properties.
Manage report history	Create, view, and delete report history snapshots; and modify report history properties.
Manage reports	Create, view, and delete reports; and modify report properties.
Manage resources	Create, modify and delete resources, and view and modify resource properties.
Set security for individual items	View and modify security settings for reports, folders, resources, and shared data sources.
View data sources	View shared data source items in the folder hierarchy; and view data source properties.
View folders	View folder items in the folder hierarchy; and view folder properties.
View models	View models in the folder hierarchy, use models as data sources for a report, and run queries against the model to retrieve data.
View reports	View reports and linked reports in the folder hierarchy; view report history snapshots and report properties.
View resources	View resources in the folder hierarchy; and view resource properties.

How to establish permissions in RS

Click the Properties tab, and click New Role Assignment.
In Group or User Name, add the alias for the person to whom you want to grant permissions.
In Role, select desired role, and then click OK.

Source Control Security Rights and Permissions

Name	Parameter used in tf	Description	Recommended only for internal use
Read	Read	Users who have this permission can read the contents of a file or folder. If a user has Read permissions for a folder, the user can see the contents of the folder and the properties of the files in it, even if the user does not have permissions to open the files.
Check out	PendChange	Users who have this permission can check out and make a pending change to items in a folder. Examples of pending changes include adding, renaming, deleting, undeleting, branching, and merging a file.
Check in	Checkin	Users who have this permission can check in items and revise any committed changeset comments. Pending changes are committed at check-in.
Label	Label	Users who have this permission can label items.
Lock	Lock	Users who have this permission can lock and unlock folders or files.
Revise other user's changes	ReviseOther	Users who have this permission can edit the comments on checked in files, even if another user checked in the file.
Unlock other user's changes	UnlockOther	Users who have this permission can unlock files locked by other users.
Undo other user's changes	UndoOther	Users who have this permission can undo a pending change made by another user.
Administer labels	LabelOther	Users who have this permission can edit or delete labels created by another user.
Manipulate security settings	AdminProjRights	Users who have this permission can set permissions on these files and folders.	√
Check in other user's changes	CheckinOther	Users who have this permission can check in changes that were made by other users. Pending changes will be committed at check-in.	√

How to establish source control permissions

In Source control explorer, right click selected node and go to PropertiesSecurity
Use tf permission command line utility to set source control permissions

Team Build Permissions

Team Build provides developers and build managers the ability to compile applications, together with associated unit test, code analysis tasks and release the build to a file server. The build results are displayed in a build report. They are also kept in the data warehouse for historical reporting. Team Build is based on MS-Build and uses a variety of Visual Studio tools like source control, work item tracking and the test tools.
Build Permissions Types:

Setup a build

To setup a build on the build machine you need to be:

An admin on the build machine
During setup you also provide a valid "build service account". This is the account under which the build process will take place.

Build Service account permissions

Needs to be a member of the "Build Services" group – this automatically gives this account all the relevant permission – remember the service account touches quite a few TFS parts as it goes through the build process
Also make sure this account has full access to the "drop location" which you specified while creating your build type using the build type wizard. This is the location where your build binaries are dropped.
The service account also needs to have "Publish Test Results" permission in case you want to include tests in your build process.
In case you are running webtests as a part of your build process, the build service account needs to be an admin on the build machine. But this is not recommended until and unless you are running webtests.

Manage Build Type

To create a build type: You need to belong to a group which has the "Administer a build" privilege AND you should have permission to check-in into the "Team Build Types" folder in source control. This is designed in this way because build type files are actually checked into this folder and any edits requires the user to check out and check-in this file and of course we don’t want everyone in the team messing around with the build scripts… do we?

Note: Often it so happens that you belong to two groups – say project administrator AND contributor. And if any one of the group has deny check-in permission enabled –then that overrides all other check-in permissions and you will NOT be allowed to play with the build type.

To edit/to delete a build type : Same as above
How to revoke permissions: in case you want to revoke creating/editing/deleting a build type from someone simply deny check-in permission to that individual using

Start a build

All that you need is "Start a build" permission to get this working.

Delete a build

You need "Administer a build" permission AND "Publish test result" permission to delete a build. The publish test result permission is required because when you delete a build – all relevant test results are also deleted. Also please note that in case this build had test results associated with it, you also need to have "Publish Test Results" permissions to delete this build.

Stop a build

All that you need is "Administer a build" permission to get this working.

View a build report

This requires "View Project Level" permission.

Edit a build Quality

All that you need is "Edit a build quality" permission to get this working.

How to establish build permissions

Find out the name of the account under which Team Build Service is running.
From Team menu, select Team Project Settings and then Group Membership, the Project Groups dialog box appears.
In Project Groups, under the Users and Groups listing, find the group called Build Services and click Properties…; the Team Foundation Server Group Properties dialog box appears.
Select the Members tab. If the account obtained above is present in the member list, then the selected build machine can build this build type. Otherwise, conduct the following steps:

In the Add member section, choose Windows User or Group and click the Add…, the Select Users or Groups dialog box appears.
In Select Users or Groups dialog box, enter the account associated with the Team Build Service on the build machine used for this build type.

If this build type is built on multiple build machines, then all the Team Build Service accounts need to be added as members of this project Build Services group.

You need to configure which users you want to be able to run build types, this is accomplished by granting the start/resume build permission

Recommended Permissions

The following section talks about recommended permission for the following roles:

Administrator
Project (group) leader
Developer (contributor)
Management

TFS Administrator

Add specified user to Server\Team Foundation Administrators group
Add user to SharePoint Administration group

On the Team Foundation application-tier, click Start, point to Administrative Tools, and then click SharePoint Central Administration.
In Central Administration, click Set SharePoint Administration Group.
In Set SharePoint Administration Group, type the group account name and the domain if appropriate.

Add user to Reporting Services Administration group:

Add user to Content Manager role in Reporting Services
Add user to System Administrator site wide role in Reporting Services

Project Lead

Add specified user to Project Administrators group
Add specified user to SharePoint Administrator group
Add user to Reporting Services Content Manager role

Developer (Contributor)

Add specified user to Contributors group
Add specified user to SharePoint Contributor group
Add user to Reporting Services Browser role

Management level, referents etc.

Add specified user to Readers group
Add specified user to SharePoint Reader group
Add user to Reporting Services Browser role

Utilities

TFSSecurity

The TFSSecurity command-line utility is installed with Team Foundation Server. Use TFSSecurity to create, modify, and delete Team Foundation Server groups and users as well as permissions for users and groups. The utility is located in <drive>:\Program Files\Microsoft Visual Studio 2005 Team Foundation Server\Tools.
For full utility description, see TFSSecurity Command-Line Utility Commands, SRL Blog

Tf

The tf command-line utility is installed together with Team Explorer (TFS client) and is aimed to perform various TFS management tasks. It is located in <drive>:\Program Files\Microsoft Visual Studio 8\Common7\IDE and is available from the Visual Studio 2005 Command Prompt. To manage user/group permissions use tf permission command.
For full utility description, see Tf Command-Line Utility Commands.

TFSAdmin

TFS Admin Tool is an open source utility. It allows a TFS administrator to quickly add users to all three platforms utilized by Team Foundation Server: Team Foundation Server, SharePoint, and SQL Reporting Services, all through one common interface.
Team Foundation Server Administration Tool

TFS Permission Manager

User friendy utility that allows you to

Add or remove TFS group membership, Reporting Services role membership and SharePoint role membership
Set Server and Project-level permissions
Set AreaPath and Source Control permissions
Create new TFS users with permissions identical to those of specified existing user
Save user permissions as template and use it later to create new or update existing users.
Manage groups

See TFS Permission Manager

Resources

SRL Team Blog