Recently I encountered the error TF14098: Access Denied: User DOMAIN\user needs Checkin permission(s) for $/teamproject/folder/* while delete a TFS branch. In this post, I want to share experience troubleshooting this issue. I am using TFS 2015 that is hosted on permises with latest update. I am also a TFS admin with project collection administrator rights.
When I first saw this error, I was felt that I knew why this happened. We had two branches DEV and TEST. TEST was branched from DEV. DEV had folder called Binaries and in it there was a particular .dll which had explicit DENY checkin permissions set for [Project]\Contributors, [Project]Project Administrators, [Collection]\Project Collection Administrators. I thought that since TEST was branched from DEV all those permissions would have been in effect in TEST. I right clicked on the TEST/Binaries/our.dll from within TFS source control explorer, then click on Advanced and then on Security.
After that I made sure that those three permission were set to Allow and nothing was deny. I was confident that this would work but it did not worked. Again the same error. Access Denied.
Next I opened visual studio developer command prompt in administrator mode and then navigated to the actual workspace folder locally and then ran the command tf permission or tf vc permission as follows:
>tf vc permission $/project/test /recursive | clip
This will copy all the permissions on files in your workspace recursively and copy it to your clipboard which you then can paste inside notepad and do search on deny. I found the Groups that had Deny permission set for that particular file. I double checked that file’s permission inside TFS source control explorer thinking something might have gone wrong. I tried deleting the branch again. Same error. Then I deleted just that file to get rid of the permission error. This time I was super confident that this would fix the issue since there is no file locally or on the server. I tried again. Same error. Then I read that in this msdn forum that permissions can even exists on a path even if no file exists on the server. Which makes sense if you think about it that on the server path could still exists even if there are no file in a branch since a branch only has pointers to the contents in it. I used the following command to set allow on that file as follows:
>tf vc permission $/project/test/binaries/our.dll /allow:* /group:”[Project]\Contributors”,”[Project]\Project Administrators”
I tried deleting the branch again inside visual studio and then tried checking in again and finally it worked this time. I hope this helps.
No comments:
Post a Comment