Access Denied on TFS - PendChange permission

Question

When I try to check out a file from TFS I get the error TF14098: Access Denied User [username] needs PendChange permission(s) for [path].

I have added the user to the contributor group but it still won't let them check out a file.

Solution 1

Sometimes it may take a bit for the permissions to take synchronize.

http://msdn.microsoft.com/en-us/library/ms400712.aspx#doesnottake

Solution 2

This is frustratingly stupid. So, if you're having this similar issue, but you can't find the actual permissions you need to change and can't seem to find where these permissions are set via your IDE, it's because you need to actually access the permissions by right-clicking on the Project and selecting Advanced->Security, not going to Team->Team Project Settings/Team Project Collection Settings->Security. You can do this with tf commandline too using tf special tf commands, but I had issues with that.

Solution 3

If the user (or AD security group) you modified was already known to the system, changes should be instant. Synchronization only comes into play in the opposite scenario: a security group already had PendChange allowed, then a Windows admin added a new user to that group. TFS won't know about the change until it talks to active directory during the next scheduled sync.

The most likely cause for what you're seeing is permission inheritance. Even if the user is explicitly Allowed a permission, any Deny ACLs that apply to him will override it. For example, ACLs set on a parent item might be inherited. Similarly, if the user is a member of two groups (eg Contributors and Readers), he could have conflicting ACLs in play -- and Deny will always win.

In addition, the model for inheritance was changed slightly in 2008 SP1. See:

• http://blogs.msdn.com/mohamedg/archive/2009/03/23/deny-revisited.aspx
• http://blogs.msdn.com/dstfs/archive/2008/12/12/how-to-allow-access-to-a-child-folder-without-allowing-access-to-the-parent-folder-in-tfs-source-control.aspx

Solution 4

Using tf perm and tfs ui I found that the PendChange permission was granted by giving the specified usergroup Checkout permissions to the root of the project in the security tab of TFS 2015.

PendChange = Check Out permission

View more solutions