partitioned administration

[globalguy]

I would like to have a number of enterprise admins. Is this a current
function of project server 2002 and 2003? Basiclly, I need to have
them only admin their projects and not eachothers via Project Pro or
PWA.

Maybe I'm missing something, since I am just researching the install
now. It seems like an obvious function to me. Thanks for any
suggests.

 

[Dale Howard [MVP]]

globalguy --

I'm not sure what you mean by "admin their own projects." What admin
functionality do you want each PM to have? Please tell us more and we will
try to help you.

 

[globalguy]

"Administrate their own published projects" is what I mean, once PWA
administrators are created.

What I envision is:

1) Create a VPN for each extranet group
2) Assign/Create a resource pool for that particular VPN. (I'm not
100% on this)
3) PM's from that VPN create projects/ assign resources & publish
projects
4) The administrator from that VPN (extranet group) can ONLY
administrate those particular published projects and not ALL projects
in the project server. (thus- partitioned security)

Is this scenario possible without too much trouble?

 

[Dale Howard [MVP]]

globalguy --

To accomplish what you wish, you do not need to use VPN for this purpose.
Instead, the default permissions in Project Server 2003 allow each member of
the Project Managers group to see only his/her own projects, and he/she
cannot see or access the projects belonging to any other manager. That will
accomplish one of your requirements.

To accomplish your other requirement regarding resources, you can set up
Project Server security so that each PM can see and assign only his/her own
resources through the use of Groups and Categories. Refer to the following
FAQs for information about how to use RBS to control access to resources:

http://www.projectserverexperts.com/Shared Documents/rbsprimer.htm
http://www.projectserverexperts.com/Shared Documents/UseRBStoControlAccessToResources.htm

Notice in the above FAQ's that the key to controlling access to resources in
Project Server is through the user of the RBS field. To give you even more
information about configuring Project Server 2003, refer to the following
FAQ about documentation and training:

http://www.projectserverexperts.com/Shared Documents/PS2003Documentation.htm

Hope this helps.

 

[globalguy]

Dale-

Thanks for the pointers. I will follow-up later after reviewing your
company's website. I thought the VPNs would be required since I have
users from outside our windows 2000 domain and I needed those users in
the resource list (Active Directory) to use the Build Team tool.

To clearify your reply, upon publishing with Project Pro, a PM sees
only his resources including the user to be assigned PWA Administrator.
Once the Administrator Role is filled, the data access, and therefore
the administration functions is limited to that PM's published projects
only.....right?

Thanks

Dick Landon

 

[Dale Howard [MVP]]

Dick --

I will invite you to re-post your question in this newsgroup about using VPN
for users outside of your domain and let our technical folks give you a
recommendation.

Regarding your last question, no. The default permissions in Project Server
2003 limit each PM to see only his/her own projects, but do allow each PM to
see ALL resources in the Enterprise Resource Pool. If you wish to limit
each PM to see only his/her own resources, you must use RBS to define which
resources can be seen by a PM, and the FAQ's tell you how to do it. Please
study those FAQ's carefully.

Also, I would strongly recommend that you stop using the term Administrator
to refer to those who have Project Manager permissions within the system.
The Project Managers group and the Administrators group are two entirely
different entities, and have entirely different permissions within Project
Server. If you keep using the term Administrator, this will only confuse
those who try to answer your questions. Hope this helps.

 

[Gary L. Chefetz [MVP]]

Globalguy:

You're looking for advice on architecting a solution which begs for a full
set of requirements to yield meaningful advice. Further, you're using
(perhaps misusing) words that have very specific meanings in the Project
Server environment, adding a significant degree of confusion for anyone
attempting to answer what is a very significant question with very little
information. With that said, you might be better served by separate
instances of Project Server, rather than one instance with a very complex
security matrix. This decision is not something that can be settled in a
news group post.

You should read the configuration and planning guide as well as the
installation guide to help prime your thoughts on this. See the following
page for the complete technical library included in the Project resource
kit:

http://www.microsoft.com/technet/prodtechnol/office/proj2003/reskit/default.mspx