TFS Integration Tools - Issue: TFS WIT invalid submission conflict type
Explains how to resolve the "TFS WIT invalid submission conflict" in TFS Integration Tools by adjusting permissions and enabling bypass-rule …
TL;DR; Explains how to resolve TFS Integration Platform errors caused by missing permissions for bypass-rule submission by adding accounts to the Team Foundation Service Accounts group.
When you run the TFS Integration Platform for the first time with TFS WIT bypass-rule submission enabled you will likely get the following error:
Figure: A Runtime Error
Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.PermissionException: TFS WIT bypass-rule submission is enabled. However, the migration service account ‘TFSService’ is not in the Service Accounts Group on server ‘http://tfsserver:8080/tfs/msf_migrate’.
at Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.VersionSpecificUtils.CheckBypassRulePermission(TfsTeamProjectCollection tfs)
at Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.TfsCore.CheckBypassRulePermission()
at Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.TfsWITMigrationProvider.InitializeTfsClient()
at Microsoft.TeamFoundation.Migration.Tfs2010WitAdapter.TfsWITMigrationProvider.InitializeClient()
at Microsoft.TeamFoundation.Migration.Toolkit.MigrationEngine.Initialize(Int32 sessionRunId)
Only accounts in the Team Foundation Service Accounts are aloud to access the web services directly. By default the account used to install TFS is not added to this group.
In addition you will also be unable to add the account through the UI as editing this group directly is disables. It is meant to be used under the covers for Lab or Build accounts, but the TFS Integration Platform is not an out-of-the-box tool.
Figure: You can’t edit Team Foundation Service Accounts
This is a special group that does not allow you to populate it through the UI. You can however view it and all of the accounts that you use for your Build Agents, Build Controllers and other bits and bobs will all be in this list already.
You need to use the the command line
Use the tfssecurity.exe tool to update the Service Accounts Group and add the “TfsAdmin”.
Figure: Updating the TFS Security group
You use our old friend the command line. There is an application called TfsSecurity that will allow you to add an account directly to that group.
1tfssecurity /g+ "Team Foundation Service Accounts" n:domainusername ALLOW /server:http://myserver:8080/tfs
Now you have that sorted you are ready to rock…
Did this help you?
Each classification [Concepts, Categories, & Tags] was assigned using AI-powered semantic analysis and scored across relevance, depth, and alignment. Final decisions? Still human. Always traceable. Hover to see how it applies.
If you've made it this far, it's worth connecting with our principal consultant and coach, Martin Hinshelwood, for a 30-minute 'ask me anything' call.
We partner with businesses across diverse industries, including finance, insurance, healthcare, pharmaceuticals, technology, engineering, transportation, hospitality, entertainment, legal, government, and military sectors.
Graham & Brown
Xceptor - Process and Data Automation
Genus Breeding Ltd
Microsoft
SuperControl
Jack Links
Cognizant Microsoft Business Group (MBG)
Healthgrades
Flowmaster (a Mentor Graphics Company)
Higher Education Statistics Agency
Akaditi
Alignment Healthcare
Capita Secure Information Solutions Ltd
Deliotte
Lockheed Martin
Slaughter and May
Brandes Investment Partners L.P.
MacDonald Humfrey (Automation) Ltd.
Royal Air Force
Nottingham County Council
Ghana Police Service
Washington Department of Enterprise Services
New Hampshire Supreme Court
Department of Work and Pensions (UK)
Bistech
Deliotte
Teleplan
Ericson
ALS Life Sciences
Trayport