Permission levels on new project workspace

[oldbradfordian]

When I create and publish a new project, a new workspace (site) is
automatically created and users are added as "Readers Microsoft Office
Project Server)" except that I am added as a "Project Manager (Microsoft
Office Project Server)". Also, the Site Permissions page indicates that "This
Web site does not inherit permissions from its parent."

When I look at the Permission Levels for the new site (under Site Settings -
Advanced Permissions - Settings), the Project Manager role has all
permissions enabled (i.e. checked boxes) for List Permissions. I do not want
the Project Managers to be able to Delete Items (for example). Similarly, the
Team Members role allows Team Members to Delete Items and Delete Versions. I
do not want them to be able to delete things.

Where are these "default" settings coming from, and how do I change them for
future new workspace sites that get created for new projects?

Thank you.

 

[Andrew Lavinsky]

Stephen Sanderlin had a good blog post on just this topic:

http://www.epmfaq.com/ssanderlin/pr...-default-project-web-access-permission-levels

 

[oldbradfordian]

WoW! Thanks for the link. What a scary proposition to have to go that route.

With all the complications and twists and turns Microsoft makes you go
through trying to understand and setup permissions, groups, categories, etc,
- in the name of flexibility - I'm amazed that at the end of the day they do
domething like this, and don't allow you to change the default settings for
the four pre-defined PWA roles. That's the ultimate in inflexibility and, it
appears to me, defeats much of the other settings that were so painful to
configure!

Is there really no simpler way to protect people from themselves by allowing
them to inadvertently or otherwise change or delete something in this very
complex user interface environment?

Thanks again for the help.

 

[Andrew Lavinsky]

If it was easy, you wouldn't need a consultant.

WoW! Thanks for the link. What a scary proposition to have to go that route.

With all the complications and twists and turns Microsoft makes you go
through trying to understand and setup permissions, groups, categories, etc,
- in the name of flexibility - I'm amazed that at the end of the day they do
domething like this, and don't allow you to change the default settings for
the four pre-defined PWA roles. That's the ultimate in inflexibility and, it
appears to me, defeats much of the other settings that were so painful to
configure!

Is there really no simpler way to protect people from themselves by allowing
them to inadvertently or otherwise change or delete something in this very
complex user interface environment?

Thanks again for the help.

 

[oldbradfordian]

In a separate posting, Jonathan Sofer observed that there is a known bug that
was fixed in the latest April 3rd hotfix package:
http://support.microsoft.com/kb/950816

List of issues that are fixed:
........
You create a project in Project Server 2007, and you add a resource to the
project. However, you do not assign the resource to a task. You publish the
project plan to a Windows SharePoint Web site. Then, you assign the resource
to the task, and you republish the project. In this scenario, the Windows
SharePoint Web site permission for the resource is "reader." However, you
expect the permission to be "team member."
........

I installed this hotfix and it does fix the problem as stated.

However, it should be noted that this fix also changes the behavior
regarding the PWA permissions, and it does so in a way that is a huge plus
for me. Before the hotfix, if I customized the permissions for Team Members
and Project Managers for a specific workspace site, my changes would be lost
the next time I published a project; they would be overwritten by the default
Microsoft permissions each time I published. After installing this hotfix, my
customized permissions are preserved through a publish of the project. So
even though it is not possible to modify the default settings, at least it is
now possible to change the settings only once when each workspace is created
and those settings are then preserved for that workspace.

Hope this is helpful to others too.