I need to make the project files read-only by default, and make them writable if and only if I check out the files for local editing.
I thought that was the default behavior, but for some reason I lost it. How could I get it back?
(My ultimate intention is to prevent developers from editing files without first checking out.)
It looks like you are using the “Local Workspaces” feature of TFS 2012.
This means all files are writeable and do not need to be checked out to remove the read-only flag (much like SVN and Git). As soon as you make a change to a file, it will be checked out.
You can change TFS to default to Server Workspaces, or just setup workspaces as Server Workspaces for each developer.