none
Best practices for adding company employees from AD as Project Server users RRS feed

  • Question

  • Hi All,

      We faced with situation when we need to add all employees as Project Server users.
    All our users have Active Directory accounts. What are the best practice for adding them into resource pool of Project Server except manually adding one by one into specific AD group and sync with it (quite illogical to add manually several hundreds or even thousands of users)? 

      What are the conditions we have to adhere to, in order to avoid errors when synchronizing all users with AD?

    Maybe you know about some free tools which can help with this task?


    Alexey


    • Edited by Alexey Koval Wednesday, November 21, 2012 7:45 AM
    Tuesday, November 6, 2012 4:28 PM

Answers

  •  

    Hi Alex,

    If you are using Project Server 2010, you don’t have to pay too much of attention for failure of AD sync job, since in 2010 AD sync job add/remove each user at a time, e.g. if you have 500 users in AD  group and if AD sync fails at 50%, you still have 250 users already added into PWA. After resolving the error if you continue, next time remaining 250 users will be added to the PWA resource pool. In 2007 AD sync job used to remove all first and then add all of them at once which often caused lot of trouble to large organizations

    How many users we are talking about. It’s not only about AD sync, you need also consider  root site sync job which is followed up after AD sync job, Also any change to Team Members group (ERP) initiate job root site sync job, failure of this job causes ability of PWA user to log on. (Again only for those users from the point of failure)

    From administration point of view, adding “Domain users” in PWA is not a good idea, instead creating separate AD group would be always helpful and beneficial to administrators. When you say add domain users will be PWA users, do you mean that everyone will be acting as resources in PWA?


    Hrishi Deshpande – Senior Consultant DeltaBahn
    Blog | < | LinkedIn

    Please click Mark As Answer; if a post solves your problem or Vote As Helpful; if a post has been useful to you.This can be beneficial to other community members reading the thread.

    • Marked as answer by Alexey Koval Wednesday, November 21, 2012 7:43 AM
    Tuesday, November 6, 2012 5:38 PM
    Moderator

All replies

  •  

    Hi Alex,

    If you are using Project Server 2010, you don’t have to pay too much of attention for failure of AD sync job, since in 2010 AD sync job add/remove each user at a time, e.g. if you have 500 users in AD  group and if AD sync fails at 50%, you still have 250 users already added into PWA. After resolving the error if you continue, next time remaining 250 users will be added to the PWA resource pool. In 2007 AD sync job used to remove all first and then add all of them at once which often caused lot of trouble to large organizations

    How many users we are talking about. It’s not only about AD sync, you need also consider  root site sync job which is followed up after AD sync job, Also any change to Team Members group (ERP) initiate job root site sync job, failure of this job causes ability of PWA user to log on. (Again only for those users from the point of failure)

    From administration point of view, adding “Domain users” in PWA is not a good idea, instead creating separate AD group would be always helpful and beneficial to administrators. When you say add domain users will be PWA users, do you mean that everyone will be acting as resources in PWA?


    Hrishi Deshpande – Senior Consultant DeltaBahn
    Blog | < | LinkedIn

    Please click Mark As Answer; if a post solves your problem or Vote As Helpful; if a post has been useful to you.This can be beneficial to other community members reading the thread.

    • Marked as answer by Alexey Koval Wednesday, November 21, 2012 7:43 AM
    Tuesday, November 6, 2012 5:38 PM
    Moderator
  • Hi Hrishi,

     Thanks for your answer. We talked about one thousand users. Based on this fact and your recommendations we made a decision continue using custom security group. This can help manage members of this group and avoid of sync errors and future questions related with them. And i agree with you - sync with domain users group, despite its apparent simplicity, far not the best option for synchronization. 

       


    Alexey

    Wednesday, November 21, 2012 7:43 AM