Permissions Issue / Resource Plans

[Shawn Everingham]

I need project managers to be able to create/view/manage Resource Plans.

I have set the global security property for an individual whom plays a
project manager role in MSPS 2007 PWA. he cannot view nor create resource
plans.

I set him up with the security category of My Resources and My Personal
Projects and made sure that Manage Resource Plans and View Resource Plans is
checked for allow. He still can't see it.

Am I missing something? I also went into the VIEW and made sure that both
these categories are included in the permissions for this view...

help?

what are the exact settings to allow this as I'm afraid I have too many
things set now.

Thanks!

 

[Dale Howard [MVP]]

Shawn --

Umm....the default settings in Project Server 2007 allow members of the
Project Managers group to view, create, and manage Resource Plans. What
have you changed in the default security setup in Groups and/or Categories
that might cause this problem? Without knowing the changes you have made,
it will be very difficult to diagnose the source of your problem. Let us
know.

 

[Shawn Everingham]

nothing in the default security settings for those roles...
but maybe some secondary setting, like in the view itself, ya know? or some
group setting like, my organization, or my resources, or my personal
projects...

How would I share those settings in a plain text forum like this? *just
curious*

Thanks Dale!

Shawn
--
Technology, like art, is a soaring stretch of our imagination...Daniel Bell.
1919
------------------------------
MSPS 2007
MS Server 2003

Shawn --

Umm....the default settings in Project Server 2007 allow members of the
Project Managers group to view, create, and manage Resource Plans. What
have you changed in the default security setup in Groups and/or Categories
that might cause this problem? Without knowing the changes you have made,
it will be very difficult to diagnose the source of your problem. Let us
know.

 

[Dale Howard [MVP]]

Shawn --

There is no way to share the current security settings for Groups and
Categories as plain text, as far as I know. If you have our Implementing
and Administering Microsoft Office Project Server 2007 book, we list the
default security settings for every Group and Category. If you have the
default settings in place, then your PMs will be able to create Resource
Plans for Proposals and enterprise projects. I suspect your Project Server
administrator has changed something somewhere in a Group and/or Category
which results in your problem. For example, has a permission in a Group
and/or Category been set to Deny, and your PMs are a member of that Group?
That is one probable cause. Without actually seeing your Project Server
2007 system, I doubt I can be of much more help than giving general
guidance. Hope this helps.

nothing in the default security settings for those roles...
but maybe some secondary setting, like in the view itself, ya know? or
some
group setting like, my organization, or my resources, or my personal
projects...

How would I share those settings in a plain text forum like this? *just
curious*

Thanks Dale!

Shawn

 

[Shawn Everingham]

Thanks Dale...I am the administrator.

I do have ya'lls books.

So...If I have an individual who is a PM I set them with the PM Group, can
that person also be a member of Resource Manager group and Team Member group?

Cause most of my PM's are a member of all 3 groups.

Thanks for any additional help you can provide!

Shawn
--
Technology, like art, is a soaring stretch of our imagination...Daniel Bell.
1919
------------------------------
MSPS 2007
MS Server 2003

Shawn --

There is no way to share the current security settings for Groups and
Categories as plain text, as far as I know. If you have our Implementing
and Administering Microsoft Office Project Server 2007 book, we list the
default security settings for every Group and Category. If you have the
default settings in place, then your PMs will be able to create Resource
Plans for Proposals and enterprise projects. I suspect your Project Server
administrator has changed something somewhere in a Group and/or Category
which results in your problem. For example, has a permission in a Group
and/or Category been set to Deny, and your PMs are a member of that Group?
That is one probable cause. Without actually seeing your Project Server
2007 system, I doubt I can be of much more help than giving general
guidance. Hope this helps.

nothing in the default security settings for those roles...
but maybe some secondary setting, like in the view itself, ya know? or
some
group setting like, my organization, or my resources, or my personal
projects...

How would I share those settings in a plain text forum like this? *just
curious*

Thanks Dale!

Shawn

 

[Dale Howard [MVP]]

Shawn --

Yes, a PM can be a member of all three security Groups, but setting a Deny
permission in any one of those Groups can deny the permission in all Groups.
My only question is why you need to add the PMs to the Team Members group,
since the permissions in the other two Groups will allow them to do
everything a team member can do, plus all of their other permissions as
well. So, back to the Deny permission issue? Have you used any Deny
permissions in Group or Category? Let us know.

 

[Shawn Everingham]

No Deny permissions ANYWHERE. Not sure why we implemented each PM as a
resource manager and a team member...I guess because a PM can be Resource
manager and Can be a team member...I adopted the original configuration.

So...no deny permissions on any group or category.

Also, the only view for Resource Plans, is Resource Plans. The message that
my PM needing to create resource plan gets, is 'There are no resource plan
views available. Contact your administrator to have view defined.'

So, in the Resource Plan view, I do not have Filter Resource to user's RBS
Brand, repeat, DO NOT have that checked. In the security categories, I have
My Organization and My Projects in the 'Categories this view belongs to:'
area.

I don't know why he would be getting this error. Him as a resource in PWA,
is now a member of the Project Manager Group ONLY. No selected Categories are
selected...and in his global permissions, I even explicity set View Resource
Plan.

What can I be missing? thanks again Dale!

 

[Dale Howard [MVP]]

Shawn --

Open the Project Managers group for editing. In the Selected Categories
list on the right, select the My Organization category. In the Permissions
grid, is the Manage Resource Plan option set to Allow? If not, do so. Let
us know what you find.

 

[Shawn Everingham]

Ok, call me stoopid, but I need a little clarification on that one...

Should there be any other categories in the selected category list? As I
just removed two of them so that I only have My Organization in the sected
Category list.

Now, I have My Organization selected...which permissions grid...the
Permissions for My Organization grid? or the Global Permissions (which is
rolled up)?

So...If you are speaking of the Permissions for My Organization Grid, no,
Manager Resource Plan is not checked...I am checking it per your
instructions. I had my PM try it with these new settings and he is now
reporting a different message...
'You do not have sufficient permissions to view the specified page. Please
contact your adminstrator for permissions to this page.'

hey, that's progress...what am I missing now?

THANKS!!! Shawn

 

[Dale Howard [MVP]]

Shawn --

Yes, by default there should be three Categories listed in the Project
Managers group: My Organization, My Personal Projects, and My Projects.
Grab your Implementing and Administering book and add back the two
Categories you accidentally removed. Then set the permissions for the My
Personal Projects and My Projects categories in the Project Managers group
per the documentation in the book.

The fact that the Manage Resource Plan permission was not set to Allow for
the My Organization category means that someone CHANGED IT. Is that person
you? If so, that is probably the source of your original problem. Hope
this helps.

 

[Shawn Everingham]

at this point, I can't say if I changed it or I adopted it that way. This is
something that has never worked for anyone except an admin (me) and now that
we have one or two folks interested in having an Activity plan w/ a resource
plan is when I started trying to be the security hero.

I'll run thru that chapter...I've tried to start reading it about 10 times
today, but keep getting interupted, and am hoping that everything I need is
in there, otherwise, my PM still can't edit/create a resource plan

Thank you Dale!

 

[Dale Howard [MVP]]

Shawn --

If you inherited the system from someone else, then I would suspect that
he/she was the one who changed the permission. If you reset all permissions
for the Project Managers group back to their default values, including the
Category permissions for the My Organization, My Projects, and My Personal
Projects categories, then I think you will find that Resource Plans now
work. If you did inherit this system from someone else, heaven only knows
what else he/she changed? Didn't this person leave you any kind of
documentation about how the configured Project Server 2007, or why? Hope
this helps.

 

[Shawn Everingham]

Dale,

Actually, that is working now...problem is...other project managers can't
even get to PWA...grrr!!

So...every resource should only be associated to one security group?

also, should every resource also have some category or should that be blank
on each resource?

sorry for sounding like I haven't read this chapter, but this is all blowing
up on me at once.

Thanks!

 

[Dale Howard [MVP]]

Shawn --

Wrong assumption. You can assign users to multiple security Groups if you
have a good reason for doing so. For example, if a project manager also
serves as a resource manager and needs to manage the resource information in
Project Server 2007 for the resources he/she manages, then it would be
entirely appropriate to add that project manager to both the Project
Managers and Resource Managers groups. Generally, however, most users fall
into one one group. For example, most people who only work on project teams
but do not manage projects will simply be members of the Team Members group.

Also, you do not need to add Categories or Global Permissions to any user
account. All of this is handled by the permissions granted to the Group to
which the user belongs. You only add a Category or set Global permissions
as an OVERRIDE to the permissions granted through the Group to which the
resource belongs. Our philosophy, which you will see detailed in the book,
is KISS (Keep It Simple, Silly). Only add Categories or set Global
Permissions on a user account as an EXCEPTION, and keep the number of
exceptions small to make your environment easier to manage.

From the sounds of things, you really need to read that entire chapter.
Read it...believe it...live it. Hope this helps.

 

[Shawn Everingham]

thanks for that clarification.

So...I have all of my project managers included in the resource manager
group, and the team member group. Those that are set up that way, after
monkeying around with all these security settings to allow access to resource
plans, they can't get to PWA home page, UNTIL I remove the resource manager
group from their user account and the team member group from their user
account. This however, leaves them unable to open up any projects they
own...wow...

I'm reading...and have a lot of reading to do tonight.

Hopefully this is an easy fix...I thought we were keeping it simple, as I am
all about ackems razor.

Thanks for all your help today Dale. A much needed crash course in security
model...

Maybe you have a quick pointer for why my PM's can't open their
projects...but if not, I hope to discover it in those 100 or so pages.

Shawn

 

[Dale Howard [MVP]]

Shawn --

Here's the simple solution: reset every Group and Category back to their
default permissions. Beyond that, remove any extra Categories and/or Global
Permissions that have been added to any user accounts. Without knowing
precisely WHAT you have done today, I'm not sure I can be of more help than
this.