We are new to this MS project Server 2007 and here is how its been setup in our company:
Project Server Installation user id = "superuser"
Senior Project Manager user id = "A"
Project Managers user id = "B", "C", "D", "E"
Team Members user id = "X", "Y", "Z"
"superuser" will have the highest admin privileges.
"A" user should be able to create and edit projects created by "A","B", "C", "D", "E" users
"B", "C", "D", "E" should be able to create projects
"X", "Y", "Z" should be able to view projects over browser (PWA)
Questions:
=========
1. Can I as a "superuser" will be able to look at all the projects in the entire company and
set the READ/WRITE permissions based on users ?
If YES how ?
2. Can users "B", "C", "D", "E" able to set the READ permissions to users "X", "Y", "Z"
for the projects what have been created by them ?
If YES how ? Can someone give me step by step navigations as how to do this ?
3. Can user "B" able to set READ permissions to user "Z" for the projects what he has created ? So user "Z" can view the project over PWA ?
This question is similar to question 2.
Can someone give me step by step navigations as how to do this ?
Thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Here are the answers for your questions:
Do the standard "Out-of-the-box" security groups and categories still exist? Have they been modified?
Yes the standard out of box security groups exists, they are NOT modified.
Have you set up the RBS lookup table ( in "Server Settings" -> "Enterprise Custom Field Definition") and assigned resources an appropriate value?
NO
Should Question 1 have referred to User A?
NO, its referring to "superuser"
The answer for Question 1 is above, in my first post.
Question 2:
If "X", "Y", and "Z" do not use Microsoft project, and you are referring to giving them read only access to the projects in PWA ("Project Center"), then you can achveive this by adding "X", "Y", and "Z" to the Team Members group (under PWA -> Server Settings -> Manage Groups. ) Then Project Managers "B", "C", "D" and "E" should add these resources to the project teams for the project that they want to grant visilbilty to. (Press Ctrl-T in MS Project Professional to reach the Build Team interface.)
I think the same procedure will answer question 3.
To address some of your other requirements:
""B", "C", "D", "E" should be able to create projects"
Add "B","C", "D" and "E" to the Project Managers group in PWA -> Server Settings -> Manage Groups.
""A" user should be able to create and edit projects created by "A","B", "C", "D", "E" users"
There are a few ways to accomplish this. If you are fine giving "A" the permission to open and edit any projects in the server instance, make them a member of the "Portfolio Managers" group. (Note this group does _not_ have permissions to publish projects, though.)
If "A"'s permissions need to be restricted to just the projects saved by "B", "C", "D", and "E" but not others in the organization, you should try setting up the RBS:
To set up the RBS, first create a hierachical Lookup Table in the RBS lookup table. PWA -> Server Settings -> Enterprise Custom Field Definition. Select "RBS" in the "Lookup Tables for Custom Fields" section (not in the top "Enterprise Custom Fields" section.) Setting up the appropriate RBS could be an article itself, but you might want something like:
Company (Contoso)
Group 1 (HR)
Team 1 (Benefits)
Team 2 (Payroll)
Group 2 (IT)
Team 3 (Windows)
For the case you provide, you only need two entries, but one must be indented below the other.
Save the changes to the RBS. Go back to the Manage Users screen, and click on "A". Set their RBS value to be a parent, such as Group 1. (This will often match the corporate hierarchy group name that "A" is a member of.) Save, and edit "B","C","D" and "E", giving them RBS values which are below "A"s RBS value in the hierarchy (indented below A or one of its children, not indented below another group.) In the example I provided, they would be set to Team 1, with "A" assigned to Group 1.
Now, the big change for this: This involves changing the out-of-the-box security: you may want to do this with a new category instead of altering the standard category! If you create a new category, you will need to connect it to the Project Managers group. But far simpler is to just change the "My Projects" category. Go to PWA -> Server Settings -> Manage Categories and click on "My Projects" to open it up. In the section titled "Projects" you will see three check boxes selected. Change the selection on "The Project Owner is a descendant of the User via RBS" so that it is selected as well. Save the changes to the Category.
Users "A" needs to be in the Project Managers security group.
Now any member of the Project Managers security group will have full permissions on any project owned by someone beneath them in the RBS.
This covered a lot of ground, and I know that I didn't provided detailed steps for some portions. Let me know where you need more information and I will try to provide it.
James Fraser
Business Accounts
Answer for Membership
by: jbfraserPosted on 2009-10-31 at 07:56:41ID: 25709998
To get into the details of this, we need to know more of the details of your setup.
Do the standard "Out-of-the-box" security groups and categories still exist? Have they been modified? You should start with these groups. If you need to recreate these groups, this will add a few steps.
Have you set up the RBS lookup table ( in "Server Settings" -> "Enterprise Custom Field Definition") and assigned resources an appropriate value?
Most of the permissions are assigned by administrators, and then controlled by Project Managers through adding users to the project team. Or through the RBS hierarchy. Administrators can manage permissions manually by project, but the maintenance of this will be significant, so I recommend you avoid this sort of set up.
Should Question 1 have referred to User A? Right now it reads as like you are trying to assign Superuser admin priveleges.
If you are trying to assign the superuser permissions and if the standard groups and categories are in place, then the answer to Question 1 is:
Add the SuperUser to the "Administrator" group: In PWA, go to "Server Settings" -> "Manage Users." Navigate to the user you want to give permissions, and click on their name. In the resulting page, find the Security Groups section and Add "Administrators" to the "Groups that contain this User" list. Save your changes. (Performing this action usually requires administrator permissions itself.)
The answers to questions 2 and 3 depend quite a bit on the configuration of your server, so I will wait for your response before I type up answers to those.
Some general notes on keeping your Project Server permissions manageable:
1) Don't edit any of the properties of the default Administrator group.
2) Don't use the Deny check boxes to deny permissions. If you use the Deny checkboxes you can create situations where you can lock all users out of functionality, with no way to re-enable it without a call to Microsoft Support. Also, troubleshooting is much harder if you use the Deny boxes.
3) Never assign categories directly to a user. Always assign categories to a group and assign groups to users.
Project Server can be complex, and successful implementations are often configured by a Microsoft Partner with EPM experience. They can provide training and customization to easily answer the sorts of questions you're asking.
But I'll do what I can here; please provide more information about your configuration. Thanks.
James Fraser