User's AD account deleted then recreated, now cannot access TFS

Question

I have a user who a couple months ago had access to our Team Foundation Server (TFS) 2013 instance (he was able to access queries, work items, backlogs etc via the web interface). Recently, we needed to delete his account, and recreate it. He no longer has access to TFS with the recreated account (it's the same domain\username).

What do I need to do to grant them access again? I've tried removing all permissions and adding them back, to no avail.

Solution 1

If you delete a user account three things happen.

1. The account is deleted. More importantly, the SID of the user account gets deleted.
2. The account's SID reference is removed from all security groups.
3. The account's SID reference in any resource permissions becomes an orphan.

If you recreate a user account with the same name it will have a different SID. That is why you need to reassign permissions for that user to any group or resource (files, folders, printers, etc.) again. Even if the SAM account name (the user name) and the password are the same as before.

What do I need to do to grant them access again? I've tried removing all permissions and adding them back, to no avail.

I can say with absolute certainty that you did overlook a significant (maybe small) spot, when you added those permissions back. Probably group permissions (see point 2. above).

Solution 2

Daniel answer is correct, but you can do better. TFS has a little know utility to manage user identities described at https://msdn.microsoft.com/en-us/library/ms253054.aspx.

TFSConfig Identities /change

Probably is too late, but imagine this sequence of actions.

1. Account DOMAIN\user is deleted (SID 1234) from AD
2. TFS will mark the identity deleted in its DB
3. Create account DOMAIN\user-temp (SID 2345)
4. Reassociate TFS identity DOMAIN\user to DOMAIN\user-temp using TFSConfig
5. Rename DOMAIN\user-temp to DOMAIN\user

Comments

[joeqwerty]

As Daniel stated in his answer, the new user account and the old user account are different objects and have different SID's, despite their being named the same. You'll need to grant the new user account the permissions that the old user account had in TFS as well as adding them to the same groups as the old user account and granting them NTFS permissions to any files/folders that the old user account had individual permissions to (if permissions were granted to users rather than groups).