Question

Does anyone know if it is possible to prevent a work item from being assigned to a specific user account in TFS?

After migrating a TFS from one domain to another, some of my team members have two user accounts, the original one from the old domain, and a new one from the new domain. I’d like to stop work items from being assigned to the old account.

Answer 1

Most process templates restrict username fields with the rule. (If yours doesn’t, you should do so.) Then all you need to do is remove the invalid accounts from TFS Valid Users group.

Unfortunately, you can’t do this directly — TFS manages this group automatically based on ACLs found throughout the rest of the system. You have to hunt them down. See these threads for more details:

• http://social.msdn.microsoft.com/Forums/en-US/tfsadmin/thread/6e5af2ab-1cbc-4d12-9078-454147926316
• http://social.msdn.microsoft.com/forums/en-US/tfsadmin/thread/1ce8b5b0-9924-45ed-919b-49a6a61bb7c7

Once you find all instances where the old domain is being referenced, the general strategy for cleaning up orphans is to add a new ACL, wait for TFS to sync (or iisreset), then remove everything.

However, this may not be possible if you’ve taken the old domain offline, or there’s no trust relationship between the two domains, etc etc. At some point it becomes easier to edit TfsIntegration manually. I usually don’t recommend mucking in the TFS databases since it’s unsupported and subject to change with every patch. For optimum safety, I’d still strongly suggest using stored procedures rather than trying to interpret the schema relationships (and make sure you hold the necessary locks, etc). prc_security_delete_identity is your best entry point: all you need to know is the old account’s SID.