How do I prevent a user from seeing the entire team project list in Team Explorer?

Question

I have a user who has access to one project on the team foundation server at my office. When they view source control, they only see the source for that single project (which is correct). The problem I have is that when they go to add a project to their team explorer, they get the entire project list from the server. Is there a way to prevent the user from seeing that entire project list? I have tried granting the user with as minimal access as I can, but they still are seeing the entire project list.

Answer 1

By default, everyone in the Valid Users group gets the GENERIC_READ permission on the whole server. You need to remove the users' GENERIC_READ permission from the server level and only grant it at the project level.

Unlike version control permissions, server-wide and project-wide permissions are set by the TfsSecurity.exe utility: http://msdn.microsoft.com/en-us/library/ms252504.aspx You can also do it from Team Explorer but I forget the exact steps.