User account keeps getting set to Inactive

[Tony Murray]

Hi all

I have a Project Server user that I have configured for Windows
Authentication. His Project Server account keeps getting set to Inactive
status for no apparent reason.

There doesn't appear to be anything wrong with his Windows login.

Any ideas on what might be causing this?

Tony

 

[Dale Howard [MVP]]

Tony --

Are you using Active Directory synchronization, by chance? If so, the AD
synch will set any Project Server resource to Inactive when that resource
does not appear in Active Directory. Let us know if this explains your
situation.

 

[Tony Murray]

Hi Dale

Thanks for responding to this.

The user in question has an active AD account. I am using AD
synchronisation, as follows:

I have created AD groups corresponding to all of the standard Project Server
groups, (e.g. Team Leaders, Portfoliio Managers, etc.). The only Project
Server group I have not configured for AD sync is the Team Members group.
The reason for this is that I have set up AD sync to populate the Enterprise
Resource Pool (in the Server Configuration settings) and this automatically
adds accounts to the Team Members Project Server group.

The user in question is a member of the Administrators group, but not part
of the Enterprise Resource Pool. I suspect the problem may be due to this,
but I would have thought it possible for an account to be an Administrator
without having to be in the Enterprise Resource pool?

Tony

 

[Dale Howard [MVP]]

Tony --

To prevent AD from setting this account to Inactive, you may want to clear
the GUID for this user's account in PWA. To do so, complete these steps:

1. Log into PWA with administrator permissions
2. Click Admin - Manage users and groups
3. Select the user account and click the Modify User button
4. Set the Account Status value to Active, if necessary
5. Select the "Clear User AD GUID" option at the top of the page
6. Click the Save Changes button

Hope this helps.

 

[Tony Murray]

Dale

According to the Administrator's Guide, the steps you mention below will
have the effect of preventing any further updates from AD for the user
specified. In my case, I want the synchronisation to occur.

I've done a little more investigation and what seems to solve the problem is
adding the user's AD account to the group I am using to sync with the
Enterprise Resource Pool. This means that this user's account is now being
synched between AD and Project Server as follows:

AD PS Admins <--> Administrators
AD PS Resources <--> Enterprise Resource Pool

Tony

PS. As an aside, I find the whole AD sync quite flakey. For example, when
I add a new user to the AD group that I sync with the Project Server
Enterprise Resource Pool it automatically adds this account to the Team
Members group. This is fine and corresponds to what it says in the
documentation. But if I then manually remove the account from the Team
Members group in Project Server it is not put back in by a subsequent AD
sync. In other words, there is an initial sync, but that's it.