none
Project Server 2010 - Project Site permissions randomly dropped RRS feed

  • Question

  • Hello all!

    I'm having a very strange issue in my Project Server 2010 production environment with user permissions pertaining to Project Sites.
    Site provisioning settings are setup to create a new project site for each new project created on the server. By default the new sites inherit their user permissions. Most owners (about 90%) then go into the site, break inheritance and set their own custom user permissions.

    All user groups are synced to Active Directory security groups, no users are added manually.

    Over the past few weeks, I've been seeing random people having their permissions dropped from random sites. Sometimes even the owner of the project
    site.

    After the first 20 or so people reported the error, I did some digging, but found nothing special or out of the ordinary in the logs. So I blamed the issue on a  andom glitch(as it had not been an issue before), and went through each (143) project sites, ensured owners had full control, then sent out a notification to  have owners check their permissions to ensure they are correct on their sites.

    A week after taking this action, the same thing happened again today. This time more extreme dropping even more users than the first time. Some sites, losing ALL permissions except the System account and our two web admins.

    I am now at a loss, and happy to have any thoughts or input regarding this issue. I did see a few posts leaning towards a possible bug, but the issues weren’t entirely similar to what I’m facing. Also, if this is a bug, I can’t confirm it, nor have I found a work-around.

    I can’t spend this much time each week restoring users’ permissions if this is going to be an ongoing issue.


    ANY help or input is GREATLY appreciated here, as I’m pulling out my hair trying to figure out this issue.

    THANKS!




    Tuesday, March 20, 2012 10:24 PM

All replies

  • Hi There--

    It seems to be normal & by desgin. Permissions on the project workspace site is controlled by PWA. Any manual changes will be reverted back when there is a change at users or group's security attribute. once the resource's account is modified & saved again on PWA, permission sync for project sites is started, re-applying default permissions.
    http://social.technet.microsoft.com/Forums/zh/projectserver2010general/thread/79ab5f4d-61d4-463f-ba00-839239dd884e

    If you modify the project manager's acocunt (who is having the "Full Control" permission on project site)  manually , the "Full Control" permission level will be disappeared.  It remains only the "Project Managers (Microsoft Project Server)" permission level.

    Please see below article by Martin,
    http://nearbaseline.com.au/blog/2011/02/resetting-lost-permissions-in-project-server-2010/

    You can also handle this using the customized solution (http://nearbaseline.com.au/blog/tag/permissions/)

    Hope that helps.


    Thanks, Amit Khare |EPM Consultant| Blog: http://amitkhare82.blogspot.com http://www.linkedin.com/in/amitkhare82

    Wednesday, March 21, 2012 7:02 AM
  • I really appreciate your response, but this is NOT normal behavior. Nothing has been changed in the user groups, or security settings.

    It's not minor changes; some project sites are losing ALL permissions, including the owner of the project, while others are losing a few random members (sometimes including the owner).
    Wednesday, March 21, 2012 4:41 PM
  • Hello,

    When you say the sites inherit permissions, do you mean the permissions synchronization feature from Project Server? If yes, then your problem is a known drawback of using that feature.

    When you turn on permission synchronization in the project sites provisioning settings, then you can't customize site permissions anymore AT ALL. By that I mean just one document library with broken permission inheritance will be enough to wipe out all permissions on the whole site on a regular basis. Only way to solve that is to turn off permission synchronization and manage all permissions manually on all project sites. It's simply not a supported scenario. We have hopes it may change in a future version, but I doubt we'll see that behavior change in Project Server 2010.

    Have a look here:

    http://social.technet.microsoft.com/Forums/en/projserv2010setup/thread/f708dd4e-72ce-4009-b0a7-74c53ea3f217

    Livia

    Thursday, March 22, 2012 8:54 AM