Access Denied on TFS

Question

When I try to check out a file from TFS I get the error TF14098: Access Denied User [username] needs PendChane permission(s) for [path].

I have added the user to the contributor group but it still won't let them check out a file.

Answer 1

Sometimes it may take a bit for the permissions to take synchronize.

http://msdn.microsoft.com/en-us/library/ms400712.aspx#doesnottake

Answer 2

If the user (or AD security group) you modified was already known to the system, changes should be instant. Synchronization only comes into play in the opposite scenario: a security group already had PendChange allowed, then a Windows admin added a new user to that group. TFS won't know about the change until it talks to active directory during the next scheduled sync.

The most likely cause for what you're seeing is permission inheritance. Even if the user is explicitly Allowed a permission, any Deny ACLs that apply to him will override it. For example, ACLs set on a parent item might be inherited. Similarly, if the user is a member of two groups (eg Contributors and Readers), he could have conflicting ACLs in play -- and Deny will always win.

In addition, the model for inheritance was changed slightly in 2008 SP1. See:

• http://blogs.msdn.com/mohamedg/archive/2009/03/23/deny-revisited.aspx
• http://blogs.msdn.com/dstfs/archive/2008/12/12/how-to-allow-access-to-a-child-folder-without-allowing-access-to-the-parent-folder-in-tfs-source-control.aspx