Security of projects

[Graeme]

We are restricting read-write project access so that PMs can only read (i.e. open) all projects in the organisation category but only write (i.e. save) to those in their my projects category.

How can we further prevent a team member who happens to belong to the Project Manager group to not then get write access also?

We tried 'denying' save to 'team members' but that even locks out the owning PM who is of course a team member also.

 

[Dale Howard [MVP]]

Graeme --

Change the Deny setting to Not Allowed (neither Allow or Deny is checked)
for the Team Members group. The Deny setting is cumulative across all
groups in which a user is a member, and the Deny permission supercedes both
the Allow and Not Allowed permission. Hope this helps.

We are restricting read-write project access so that PMs can only read

(i.e. open) all projects in the organisation category but only write (i.e.
save) to those in their my projects category.

How can we further prevent a team member who happens to belong to the

Project Manager group to not then get write access also?

We tried 'denying' save to 'team members' but that even locks out the

owning PM who is of course a team member also.

 

[Graeme]

Dale, thanks for responding, unfortunately this does not help - the default is not allowed for team members but the PM group 'allow' setting then takes over (even though they are not a PM within this project - just a team member with task assigned, but they have the PM group).

Any further thoughts?

Regards,
Graeme

 

[Gagan Goel]

Aah Interesting situation...

Well first thing you want to consider here is the opposite. i.e. there are two project managers working on a same project. Now you can easily assign the second one to a task and they both are good to go.....

Any ways answer to your question is you have to modify security settings in "My Projects" category...where one of the check mark says "Allow users in this category to view all projects in which they are a team member" which is checked by default, uncheck that and you should get what you wanted....

Gagan Goel

 

[Dale Howard [MVP]]

Graeme --

Here's a solution that I think will work for you:

1. Remove any project managers from the Team Members group
2. Add My Organization category to the Project Managers group
3. In the Project Managers group, select the Open project permission is set
to Allow for the My Organization category
4. In the My Projects category, make sure that ONLY the "Allow users in
this category to view all projects they manage" option is selected

Hope this helps.

Dale, thanks for responding, unfortunately this does not help - the

default is not allowed for team members but the PM group 'allow' setting
then takes over (even though they are not a PM within this project - just a
team member with task assigned, but they have the PM group).

 

[Graeme]

Thanks, this helps a lot.

I agree this creates a situation where only one PM has rw access at once.... however, we have a situation where for the purpose of assigning issues and risks across projects within the programme most PMs will appear in each others plans just for this purpose (seems this is a requirement for home page issue notifications to function - unless you know different). Therefore without this piece of security they'd all have rw access within the programme anyway!

Regards,
Graeme

 

[Graeme]

Thanks this helps a lot.

I agree this creates a limitation that only one PM has rw access rather than them and their delegates...

However, from what I can see we have to assign other PMs a task in the plan for the purposes of assigning them to issues/risks (across the programme). Thus over time many PMs would have rw access to many projects in the programme. Unless you know different?

Regards,
Graeme

 

[Graeme]

Thanks very much Dale, this helps. Now if I could only solve the flipside issue this creates as Gagan points out..... ;-)