TF30063: You are not authorized to access

0
votes

We're currently having an issue where when someone tries to access our TFS server via Visual Studio, they're hit with an Error TF30063: You are not authorized to access

The TFS server is on a different domain to what the client machines trying to connect are on. There is a domain trust between the two and other shared resources work fine.

I have found that it does temporarily work if you open up an RDP (remote) connection to the server in the background and login using your local domain credentials. After leaving your remote session connected and trying to connect again via Visual Studio, it works fine.

Another thing to point out which indeed would be related is, looking at the Administrator group permissions on the TFS server it does not resolve the usernames of the users in the list until they initiate an RDP connection atleast once after a reboot has occurred. Instead it shows their SID.

Things I’ve tried so far are;

  • Adding Windows and Generic Credentials to the Credential Manager on the TFS server for their domain accounts. I thought it might be an issue with the server not caching their credentials which meant an RDP connection needed to exist each time.
  • Enabling Windows Authentication in IIS
  • Adding the path to Trusted Sites in Internet Options
  • Enabling Network access: Allow anonymous SID/Name translation in Group Policy for the machine.
  • Creating a registry key under HKLM\System\CurrentControlSet\Control\Lsa called TurnOffAnonymouseBlock and set to 1 which essential is what the GP above does.

None of these however have seemed to fix the issue.

Any suggestions would be greatly appreciated!

1
visual-studio-2012tfswindows-server-2012

1 Answers

1
votes

If there is a domain trust in place, you should just add the users AD account that they log into their machine with, as a valid user in TFS.

For example, if TFS is in Domain A, and the user's laptop is in domain B (and they login to their laptop with a domain B account), then you need to ensure that Domain A trusts Domain B (either a two-way trust, or one way with A trusting B). Then you just need to make sure to add the user's domain B account as a TFS Contributor for example, and they should be able to access TFS without doing anything special.