==================================

Detail/background of the intermittent issue

AD Sync process sometimes shows an error message and the process partially fails if it finds any inactive or disabled users in the AD group(s) that are synchronized. It is an issue with both the enterprise resource pool (ERP) and group sync processes. This behavior can be applicable to Windows Server 2003, Windows Server 2008 and/or to Windows Server 2012.

It has been observed that many organizations prefer to delete a User Account 30 days after user leaves the organization.

==================================

Symptom

Active Directory Synchronization job partially fails or fails with below error in the queue. 

Datasets:

• SecurityGroupsDataSet

• Table GroupMembers

• Row: RES_UID='e1f3afde-562c-e011-873d-005056ba326c' WSEC_GRP_UID='13da50ff-dcd1-455a-844a-4df08af90808'

• Error SecurityInvalidUserUidRef (19083) - column

• Row: RES_UID='e1f3afde-562c-e011-873d-005056ba326c' WSEC_GRP_UID='13da50ff-dcd1-455a-844a-4df08af90808'

• Error SecurityInvalidUserUidRef (19083) - column

General

• Queue:

GeneralQueueJobFailed (26000) - AdSyncGroup.AdSyncGroupMessage. Details: id='26000' name='GeneralQueueJobFailed' uid='af755003-572c-e301-873d-005056ba326c' JobUID='15559ecc-562c-e311-873d-005056ba326c' ComputerName='3da96d54-0dff-4a28-ab25-e00008b01dcec' GroupType='AdSyncGroup' MessageType='AdSyncGroupMessage' MessageId='1' Stage='' CorrelationUID='e81a498c-3767-700c-1dce-cdb91ab94b7e'. For more details, check the ULS logs on machine 3da96d54-0dff-4a28-ab25-e00008b01dcec for entries with JobUID 15569ecc-562c-e300-873d-005056ba326c.

==================================

 Resolution (may not be a preferred option)

• Enable Verbose Logging for Project Server (AD Sync).
• Analyze ULS logs and search for the keywords "could not be updated during Resource Synchronization because the supplied Windows account name"
• The result set should include Windows Log On name(s).
• Remove the Log On name(s) found in the ULS logs from the AD Group in question.
• Perform AD Synch after removing Log On name(s) from the AD Group. 

============================

Workaround (best option to use)

Workaround is to create the new Security Groups in AD by referencing the existing ones, with no inactive/disable users.

How does this work?

1. For example, you have three AD groups: Project Managers, Resource Managers, and Team Members, which have inactive resources. We will call these groups source groups for this example. Create three new AD groups with an underscore such as Project_Managers, Resource_Managers and Team_Members. We will call these groups destination groups.
2. Run the "Maintain AD group for Project Server sync with only active user accounts" script from the TechNet Gallery here before the AD sync jobs run: http://gallery.technet.microsoft.com/projectserver/Maintain-AD-group-for-c92e3087
3. In the second step, the script will copy all the users minus inactive/disable users, from the source groups and will paste them into the destination groups.
4. Configure AD Sync to communicate with the destination groups.

Hello, Microsoft PPM Community.

This is our monthly blog post about what is happening in the PPM Community around the world.

This means webcasts/webminars, PMI and MPUG chapter events, and all about what you need to know to stay up to date about Microsoft Project, Project Server, and Project Online.

I'm so sorry for the delay on the post of this month.

Microsoft Project Webcast Series

Cloud-based Innovation Management captured with SharePoint Online, Project Online and ERP systems

October 21 @ 12:30pm – 2:00pm EST

Innovation Management is key for companies specializing in product development as well as those pursuing organizational development. Collecting relevant ideas from employees, aligning these ideas with the corporate strategy, and executing quickly on ideas chosen are critical factors to creating momentum and success. Next to the conventional on premises systems for Project Management solutions, the demand for software services in the cloud increases constantly.
Innovation management starts with capturing project ideas. This process is supported through Ideation – the new approach with Microsoft SharePoint Online and Project Online. This webcast describes the interplay between the cloud services to support the complete project life-cycle from idea creation to evaluation of project proposals and realizing approved projects. This leads to a close integration of innovation management and the management of product portfolios and ensures predictive decision-making as well as process compliance. The solution primarily focuses on increasing transparency and improving the interaction between different departments to be able to reduce the “time to market” and the corresponding costs by supporting the workflows along the value chain. 
In addition we will show how to integrate an ERP system (in this example SAP) to enable controlling projects. A similar configuration therefore allows all involved users groups to use their respective software of choice, offers high flexibility and user acceptance, as well as supports cloud, hybrid or on premises environments. This approach is also applicable for managing all sorts of intake, for example IT demand management.  Does your company collect your employee’s innovations?

MPUG Events

Lean for Project Agility

Project Collaboration in the Cloud with Project Online 2013

With the new Project Online, Microsoft provides project managers and team members an improved tool for planning, collaboration and team communication. And that not only on-premises but also beyond the organization borders. Through the tightened integration of Microsoft SharePoint and Project, the Project Team Site is the central point of communication – even external team members can be integrated easily.
Your project culture will change due to the new collaboration possibilities. In this webinar you will learn how to:

MPUG Recordings

Webinar: “Taming the Monster Schedule” – Working with Consolidated Schedules…

Date: October 8, 2014

If you are aware of some event that will occur this month and it is not listed here, please, leave a comment with the link.

Recently, while helping a Project Server 2013 user create a new workflow, I was asked how to add an email notification to a workflow.

The request is to send an email to proposal submitters notifying them of the approval or rejection of their proposal.

We started out using information from Assign an approval task in a workflow to build a new workflow.

We decided to start with an email notification to the proposal submitter alerting them that the proposal has been approved.

1. Place the orange cursor in the top half of Stage 3.
2. On the ribbon, click Action, and then, under Task Actions, click Send an Email.
3. Click these users.
4. In the define E-mail Message dialog complete these steps.
   
   1. Click the Address Book icon to display the Select Users window
   2. Select Workflow lookup for a User
   3. Select Project Owner Email
   4. Click OK
   5. Click OK

   

5. Now you can format the Email message and click OK.

Publish the workflow and create a new proposal to test the email functionality.

Follow the same steps to add an email task to the Cancelled stage to generate a rejection email.

Symptoms

Any new project plan creation process fails with below error message in the queue. Even using out of the box Basic Project Plan EPT does not help.

General

• • Project:
    • ProjectNameAlreadyExists(1034). Details: id='1034' name='ProjectNameAlreadyExists' uid='fd477e47-c74f-e411-8d41-005056956a3d' projName=''.
  • Queue:
    • GeneralQueueJobFailed (26000) - ProjectCreate.ProjectAddToMessage. Details: id='26000' name='GeneralQueueJobFailed' uid='fd4177e47-c74f-e411-8d41-005056956a3d' JobUID='00500d41-c74f-e411-9203-005056956a39' ComputerName='dfc43234-896b-417b-b19f-a01571d6fed3' GroupType='ProjectCreate' MessageType='ProjectAddToMessage' MessageId='1' Stage='' CorrelationUID='987ac09c-1eed-a084-03d1-1f6959c4d76c'. For more details, check the ULS logs on machine dfc43234-896b-417b-b19f-a01571d6fed3 for entries with JobUID 00500d41-c74f-e411-9203-005056956a39.

Possible Cause

This error can occur if a project plan in Project Server doesn't have any name or it has blank name. 

Resolution

Open PWA with Administrator access.

1. Open PWA Settings. Click on Delete Enterprise Objects.
2. Find the name of a project plan, which is unusual or which doesn't have any name.
3. Take a backup as .mpp of the project plan in question and of the Project Site associated with it.
4. Delete the Project Plan (or rename it, if it allows you to do so), as well as Project Site associated with the Project Plan.
5. Try to create a new Project Plan and check the behavior.

The cardinal rule of permissions: Keep It Simple

• The highest rule of permissions best practice is to keep your permissions scheme simple. 

  • If you can use the default categories, groups, and permissions with only minor changes, or none at all, do so!

  • Avoid creating unnecessary groups and categories. Having a large number of groups and categories within an instance of PWA can stress the authorization system, which can affect performance.

• Use the default permissions set.

  • The default permissions in combination with the RBS (resource breakdown structure) checkboxes on Categories is sufficient to efficiently manage permissions in most customer situations with as little overhead as possible.

• Always test permissions changes in a test environment on a copy of production data. 

  • Avoid making changes to production permissions without thorough testing.

  • Use Act as Delegate feature in your test environment to determine if your permissions changes have the impact you desire.

  • If you must change permissions directly in production, only check Allow checkboxes and avoid directly selecting Deny for anything.

• Utilize the RBS checkboxes available on Categories and configure the RBS lookup table to mimic your org structure, then…Update the resources’ RBS values on a regular schedule.

  • A permissions scheme that relies on the RBS allows you to use the default permissions and allows resources to see only things based on their org structure or other breakdown structure as defined by the customer.

  • Utilizing the RBS mean you must frequently update the RBS for new resources or resources whose org structure changes.  Typically, this update should happen at least weekly. 

• Avoid creating separate security groups for team members and project managers for each project plan.

  • This creates an administrative workload every time a project is created and then every time the project membership changes.

  • Imagine having 700 projects in flight and each has two security groups, one for project managers and the other for team members.

• Avoid allowing or denying permissions on specific users.

  • The more cases where users have rights that differ from the groups they are in, the more trouble you will have figuring out why the permissions are broken for certain users.

• Avoid utilizing Deny.

  • It is important to consider when you are configuring a permission to Deny that the Deny setting supersedes any Allow settings that apply to the user for that permission by means of other group memberships. Limiting your use of the Deny setting can simplify permissions management for large groups of users.

• Configure the category and group permissions, then leave it alone.          

  • Changes to the permission scheme should be infrequent.

  • Once you have settled on a permissions scheme, leave it alone unless there is a clear business need and a formal request has been received.

• Download the Project Server 2010 Administrators Guide from here for full descriptions of groups, categories, and permissions: http://technet.microsoft.com/en-us/library/gg663916(v=office.14).aspx

• The Administrator group in PWA > Server Settings > Manage groups should not sync with any groups in AD.  An inadvertent problem with that group in AD could cause administrators to be locked out of PWA when the resource or group sync runs.