Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using groups in Active Directory to manage what users can access projects in TFS. My problem is, that even though AD shows them in the group, and even through TFS when I look at who is a member of the group, it shows the user, access is not immediately granted.

I have tried refreshing the worker procesess for TFS with no luck. A machine restart (the TFS server) does seem to fix it, but I can't be restarting my Source Control every time I make a change to AD.

How do I make AD "discover" the changes to AD more often? As of now it is some time under 24 hours before the changes finally occur and the users are allowed into the project. Also, this was happening with TFS 2005, and we upgraded to 2008, and it is still happening.

Any ideas?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Group memberships are enumerated for the user at logon. When you make changes to a users memberships in AD, the user needs to log out/in of their machine for the changes to take effect for the user. I'm guessing the "under 24 hours" you mention is due to the fact they're coming back to work the next day and logging into the machine.

share|improve this answer
1  
@izzy: Right on the money. –  joeqwerty Oct 21 '09 at 15:46
    
or is it lzzy? sorry. –  joeqwerty Oct 21 '09 at 15:47
    
That would make sense, as I never thought to have them log out and back in. Thanks so much, Izzy! –  Josh Oct 23 '09 at 17:46

TFS caches Active Directory information and is by default set up to poll Active Directory every 60 minutes. I reduced the interval on my server by adding an "IdentityUpdatePeriod" parameter in C:\Program Files\Microsoft Visual Studio 2008 Team Foundation Server\Web Services\Services\web.config

I was seeing some errors syncing with Active Directory when it was set to 5 minutes, so I changed it to run every 15 minutes (and still see errors once in a while..but at least I don't have to tell users to wait an hour)

Before:

  <appSettings>
    <add key="ConnectionString" value="Data Source=[TFS_DATA_TIER_SERVER]\tfs;Initial Catalog=TfsIntegration;Integrated Security=True;Persist Security Info=False;Application Name=TeamFoundation" />
    <add key="eventingEnabled" value="true" />
    <add key="DetailedExceptions" value="false" />
    <add key="emailNotificationFromAddress" value="DoNotReply_TFS@company.com" />
    <add key="smtpServer" value="[smtp_server]" />
  </appSettings>

After:

  <appSettings>
    <add key="ConnectionString" value="Data Source=[TFS_DATA_TIER_SERVER]\tfs;Initial Catalog=TfsIntegration;Integrated Security=True;Persist Security Info=False;Application Name=TeamFoundation" />
    <add key="eventingEnabled" value="true" />
    <add key="DetailedExceptions" value="false" />
    <add key="emailNotificationFromAddress" value="DoNotReply_TFS@company.com" />
    <add key="smtpServer" value="[smtp_server]" />
    <add key="IdentityUpdatePeriod" value="0:15:0"/>
  </appSettings>
share|improve this answer
    
Is there an equivalent setting in IIS? I am having the exact same symptoms for a web application (permissions not propagating through groups to the file system, SQL Server). –  JohnFx Aug 27 '12 at 23:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.