AD Group synchronization

[Michael McGinley]

Good day,

We were able to specify and successfully syncronize the security AD group
(ProjectServer) located within the Server Configuration menu.

We would also like to syncronize a custom group with a specific Security
group located in our AD. (ProjectAdmin)

When I removed a user from the "ProjectServer" group within AD, and placed
the user in the custom "ProjectAdmin" group, the user account became
Inactive. I realize that when it syncronized with the AD group and no longer
saw the user in the main "ProjectServer" group, it marked the user as
Inactive. We do not want the custom "ProjectAdmin" group to inherit the
secuirty of the "Team Members" group. So I what I want to know is this:

Do all of my AD users need to be specified within the AD group specified
within the Server Configuration menu?

Thanks again folks.

 

[Brian K - Project MVP]

Good day,

We were able to specify and successfully syncronize the security AD
group (ProjectServer) located within the Server Configuration menu.

We would also like to syncronize a custom group with a specific
Security group located in our AD. (ProjectAdmin)

When I removed a user from the "ProjectServer" group within AD, and
placed the user in the custom "ProjectAdmin" group, the user account
became Inactive. I realize that when it syncronized with the AD group
and no longer saw the user in the main "ProjectServer" group, it
marked the user as Inactive. We do not want the custom "ProjectAdmin"
group to inherit the secuirty of the "Team Members" group. So I what
I want to know is this:

Do all of my AD users need to be specified within the AD group
specified within the Server Configuration menu?

Thanks again folks.

sort of. That is for synching the resource pool with an AD group.Then
each Project Server Security Group can also be synched with an AD group
(one each) if you like.

Create a group in AD for each Project Server Security group you wish to
synch. Then place users in each group to which they should belong and
perform the synch. This should give you what you want. I think...

 

[Michael McGinley]

Thanks for the prompt response Brian.

Unfortunately, when I removed the users from the AD group that sync's with
the Resource Pool, the users I removed became Inactive.
When the users within the AD Group that sync's with the ERP, they are
automatically add the the "Team Members" group. This causes some issues for
the way we have security set up.

So I guess this statement is true:

Enterprise users must be in the AD group that is syncronized from the Admin
==> Server Configuration page in order to remain Active resources.

Thanks again Brian.

 

[Brian K - Project MVP]

Thanks for the prompt response Brian.

Unfortunately, when I removed the users from the AD group that sync's
with the Resource Pool, the users I removed became Inactive.
When the users within the AD Group that sync's with the ERP, they are
automatically add the the "Team Members" group. This causes some
issues for the way we have security set up.

So I guess this statement is true:

Enterprise users must be in the AD group that is syncronized from the
Admin ==> Server Configuration page in order to remain Active
resources.

Thanks again Brian.


account >> became Inactive. I realize that when it syncronized with
the AD group >> and no longer saw the user in the main
"ProjectServer" group, it >> marked the user as Inactive. We do not
want the custom "ProjectAdmin" >> group to inherit the secuirty of
the "Team Members" group. So I what >> I want to know is this:

Yes that is true. You can just drop them back in. As you found you will
need to make sure that the Team members group does not contain any
permissions that are too restrictive.

Good Luck