Contributors can edit TFS Project Group Membership?
Hello,
I’ve searched a lot about this issue but without any conclusion. I’ve created several projects where I’m Administrator and others are project contributors. This way I could prevent them from deleting projects and so on…
But one thing I don’t understand is that they can edit group membership and add them as project administrators. I want them to be able to add documents, source code, etc… but don’t want them to be able to delete TFS projects, create builds, etc… What do I have to configure to do this? I was expecting that contributors couldn’t edit Group membership.
I would appreciate your help.
Best Regards,
Rui Dias
By default, contributors do not have permission to change group membership for their project. In Team Explorer as a project administrator or Team Foundation administrator, please right-click on your project name, select "Team Project Settings" -> "Security...". In the dialog that appears, select the Contributors group and make sure that the "Edit project-level information" box is not checked.
If the group doesn't have that permission, then it's possible some other group the users are part of does. You can check the complete group membership of a user by running the TFSSecurity.exe tool on the Application Tier like so: "TFSSecurity /server:http://[servername]:8080 /imx DOMAIN\username". Then, check the permissions for any group the user is a member of in the Project Security dialog.
Also, though the dialog may appear to let you add members, please make sure that you receive an error message when you actually click "OK" as a contributor user trying to add users to the Administrators group.
Hope this helps-
Cheers,
Adam
