locked
Reset global permissions and category permissions on user level RRS feed

  • Question

  • We have configured our Project Server security with groups and categories and want a situation where every user gets the global and category permissions from that group (as this is a recommended best practice). We use Active Directory synchronization.

    But during the pilot phase of our roll-out sometimes we granted some specific global and/or category permissions on user level. Now that we have defined our final group and security structure, we want to remove those specific permissions.

    How can we do this? If I remove the group on user level and re-add it, the specifically given permissions on user level still are there. This makes it difficult to manage our user security. So we wonder how we can make those users 'follow' the group security settings and get rid of the exceptions on user level.

    Thursday, December 22, 2011 4:12 PM

Answers

  • Pieter --

    Click Server Settings > Manage Categories to navigate to the Manage Categories page.  Individually click each Category listed.  For each selected Category, navigate to the Users and Groups section of the page.  In the list of users shown on the right side in the Users and Groups with Permissions section, DO NOT remove any of the Groups, but DO REMOVE all of the user accounts.  This will quickly take care of the Category permissions you have applied as an override for some of your users.

    Next, click Server Settings > Manage Security Templates.  Click the New Template button and give it the name No Global Permissions.  DO NOT select either the Allow or Deny checkbox for any permission.  Instead, simply save this new security template.  You can use this template to quickly clear the Global Permissions you have specified as an override for your users.

    The final step is to click Server Settings > Manage Users.  Sadly, you will need to individually click the names of each user and then examine the Global Permissions grid.  When you find the first user for whom you have applied Global Permissions as an override, click the Set Permissions with Template pick list at the bottom of the Global Permissions grid, select the No Global Permissions template, and then click the Apply button.  This will quickly clear the override permissions you set, and then click the Save button.

    You are absolutely correct in your assertion that setting Category and Global Permissions overrides make it difficult to manage your security settings in Project Server 2010.  Our recommended best practice for security is to use Groups to manage the permissions for all users.  It makes security management much, much easier.  So, you will have a little bit of manual work to do to clean up your system, but the steps listed above make it a bit easier.  Hope this helps.


    Dale A. Howard [MVP]
    VP of Educational Services
    msProjectExperts
    http://www.msprojectexperts.com
    http://www.projectserverexperts.com
    "We write the books on Project Server"

    Thursday, December 22, 2011 5:30 PM

All replies

  • Hi Pieter,

    Unfortunately you will need to remove / clean up the permissions assigned directly to the users manually.

    Thanks

    Paul


    Paul Mather | Twitter | http://pwmather.wordpress.com
    Thursday, December 22, 2011 4:17 PM
  • Pieter --

    Click Server Settings > Manage Categories to navigate to the Manage Categories page.  Individually click each Category listed.  For each selected Category, navigate to the Users and Groups section of the page.  In the list of users shown on the right side in the Users and Groups with Permissions section, DO NOT remove any of the Groups, but DO REMOVE all of the user accounts.  This will quickly take care of the Category permissions you have applied as an override for some of your users.

    Next, click Server Settings > Manage Security Templates.  Click the New Template button and give it the name No Global Permissions.  DO NOT select either the Allow or Deny checkbox for any permission.  Instead, simply save this new security template.  You can use this template to quickly clear the Global Permissions you have specified as an override for your users.

    The final step is to click Server Settings > Manage Users.  Sadly, you will need to individually click the names of each user and then examine the Global Permissions grid.  When you find the first user for whom you have applied Global Permissions as an override, click the Set Permissions with Template pick list at the bottom of the Global Permissions grid, select the No Global Permissions template, and then click the Apply button.  This will quickly clear the override permissions you set, and then click the Save button.

    You are absolutely correct in your assertion that setting Category and Global Permissions overrides make it difficult to manage your security settings in Project Server 2010.  Our recommended best practice for security is to use Groups to manage the permissions for all users.  It makes security management much, much easier.  So, you will have a little bit of manual work to do to clean up your system, but the steps listed above make it a bit easier.  Hope this helps.


    Dale A. Howard [MVP]
    VP of Educational Services
    msProjectExperts
    http://www.msprojectexperts.com
    http://www.projectserverexperts.com
    "We write the books on Project Server"

    Thursday, December 22, 2011 5:30 PM
  • Thank you Dale for this nice workaround, it works fine.

    This way I can clean up the individual rights we assigned in the past to switch over to group rights, like I read in your PS2010 book (which is an excellent source of information for me).

    Monday, January 2, 2012 3:59 PM
  • Pieter --

    Thank you for your very kind comments, my friend.  And you are more than welcome for the help as well!  :)


    Dale A. Howard [MVP]
    VP of Educational Services
    msProjectExperts
    http://www.msprojectexperts.com
    http://www.projectserverexperts.com
    "We write the books on Project Server"

    Monday, January 2, 2012 10:35 PM