After migration: Access Denied through PWA (fine in Project Pro)

[thinkmassive]

The machine I had running Project Server 2007 went down for good the
other day, so I've been scrambling to get everything running again
this week. I installed Windows Server 2003 and Project Server 2007 on
a new machine, and I restored my Project Server 2007 databases from
the latest backups.

Now I seem to have an operational Project Server except the only
account allowed to login through Project Web Access is the new admin
account I enabled during setup. The previous Project Server
installation was based on the "simple" configuration instead of a
Server Farm installation, which is what I used this time. I can
connect through Project Pro as any of the Project admins, but these
same accounts result in "Access Denied" errors through PWA.

I did have to update the "user logon account" (under Server Settings-

Edit User->User Authentication) to authenticate against Active

Directory because the previous system authenticated against Windows
local users, which no longer exist on the new machine. To make sure
this wasn't the only issue, I created a new Project user that
corresponds to a new AD user, but this account doesn't work either.

I find it strange that the old accounts (remapped to AD instead of
local users) will connect through Project Pro but everyone is denied
access through PWA, except for the account I specified as the Project
admin during setup. The problem isn't IIS because I can view pages
fine and that single account will login fine, so I also believe the
problem is not SharePoint Services. It also can't be Active Directory
because, once again, the admin account works fine, as do the old
accounts (remapped to AD) when used through Project Pro.

What other settings should I check to allow my users back into PWA?
Thanks!

 

[Jim Erwin]

Are you maybe using Kerberos authentication? I had a similar problem
after a restore where we setup the new installation to use NTLM, but
the logs were showing Kerberos problems with authenticating. Just a
thought. Try logging in at a specific time with an account that will
fail and then check all the logs for that time (just to simplify the
search through the logs).

 

[thinkmassive]

The authentication type is set correctly because I can login with the
admin account and Event Viewer displays a "Successful Network Logon"
event for every account I've tried. I also just noticed that the
admin account is only granted access to PWA from IE running on the
machine where Project Server resides. Attempting to connect from
another machine on the network results in "Error: Access Denied" on
every successful authentication attempt.

Thanks for the input--I'll keep poking around.