Install-Module AzureAD Install-Module MSOnline

Update and run builds and releases

It seems AD and Tfs Sync was out of whack.  I got that working pretty quickly, and restarted the TfsJobAgent and ensured that the AD Sync job ran successfully. 

I verified that the users still existed in the new Tfs 2012.4 instance, so now I just needed to get the users and groups they belonged to information from the Tfs 2008 instance and replicate them in the new Tfs 2012.4 instance.  With a lil T-SQL magic, this was not such a huge deal.

So, I hopped on over to the Tfs 2008 database server; connected to the TfsIntegration database and start a new query.  Ran the following T-SQL script, save the results as Tfs2008UserGroupsRestore.cmd file.

SELECT 'tfssecurity /g+ "[' + REPLACE(REPLACE(P.project_name, '>', '_'), '"', '-') + ']\' + A.groupName 
 + '" "UserDomain\' + A.userName + '" /collection:https://TfsServer:8080/tfs/DefaultCollection' AS Query
 FROM 
 (
 SELECT 
 tbl_security_identity_cache_1.display_name as groupName, 
 tbl_security_identity_cache_1.Domain as domainName,
 tbl_security_identity_cache.account_name AS userName 
 FROM tbl_security_membership_cache INNER JOIN 
 tbl_security_identity_cache ON tbl_security_membership_cache.member = tbl_security_identity_cache.sid INNER JOIN 
 tbl_security_identity_cache AS tbl_security_identity_cache_1 ON tbl_security_membership_cache.container = tbl_security_identity_cache_1.sid 
 WHERE (tbl_security_identity_cache_1.type = 4) AND (tbl_security_identity_cache_1.sid <> 'S-1-9-1551374245-1204400969-2402986413-2179408616-0-0-0-0-3' 
 and tbl_security_identity_cache.deleted<>1) 
 ) AS A
 INNER JOIN tbl_projects AS P ON
 A.domainName LIKE '%'+ CONVERT(NVARCHAR(MAX), P.project_id) +'%'
 

Ran the .cmd file in an elevated Visual Studio 2012.4 command prompt on the Tfs 2012.4 app tier; and after a few minutes, like magic... All users have been restored to their groups.

I hope this post will be helpful to someone else in the future.  Cheers!

...
Chev

Hope you found this helpful!

/*==============================================*/
 
 -- Retrieve version of MS SQL Server
 
 Select SERVERPROPERTY('productversion') [Product Version], SERVERPROPERTY ('productlevel') [Product Level], SERVERPROPERTY ('edition') [Edition]
 
 /*==============================================*/

I personally use this awesome blog (https://sqlserverbuilds.blogspot.com) to then figure out if I am on the latest build etc..

Hope this helps!

Hopefully you'll find them handy as well.

Cheers!

--Create temp table to store the Tfs Database names
 CREATE TABLE #tmp (TfsDBName varchar(MAX)) 
 INSERT INTO #tmp VALUES ('Tfs_Configuration')
 INSERT INTO #tmp VALUES ('Tfs_DefaultCollection')
 INSERT INTO #tmp VALUES ('TFS_Warehouse')

Please pay attention to the path and name variables used.  You must edit them to match your own environment.

For Tfs2008 Databases:

 --START SCRIPT

 DECLARE @BackUpURL VARCHAR(MAX)
 DECLARE @DBBackUpFile VARCHAR(MAX)
 DECLARE @DataRestoreURL VARCHAR(MAX)
 DECLARE @LogRestoreURL VARCHAR(MAX)
 DECLARE @DBRestoreDataFile VARCHAR(MAX)
 DECLARE @DBRestoreLogFile VARCHAR(MAX)
 DECLARE @DBName VARCHAR(MAX)
 DECLARE @DBLogName VARCHAR(MAX)
 DECLARE @CompatLevel VARCHAR(MAX)
 
 --Set the URL Variable bellow to the root of your DB backup folder
 SET @BackUpURL = N'C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\BackUp\'
 SET @DataRestoreURL = N'C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\'
 SET @LogRestoreURL = N'C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Log\'
 
 --Create temp table to store the Tfs Database names
 CREATE TABLE #tmp (TfsDBName varchar(MAX)) 
 INSERT INTO #tmp VALUES ('TfsActivityLogging')
 INSERT INTO #tmp VALUES ('TfsBuild')
 INSERT INTO #tmp VALUES ('TfsIntegration')
 INSERT INTO #tmp VALUES ('TfsVersionControl')
 INSERT INTO #tmp VALUES ('TFSWarehouse')
 INSERT INTO #tmp VALUES ('TfsWorkItemTracking')
 INSERT INTO #tmp VALUES ('TfsWorkItemTrackingAttachments')
 
 DECLARE db_cursor CURSOR FOR 
 SELECT TfsDBName FROM #tmp
 OPEN db_cursor 
 FETCH NEXT FROM db_cursor INTO @DBName 
 WHILE @@FETCH_STATUS = 0 
 
 BEGIN 
 
 SET @DBLogName = @DBName + N'_log'
 SET @DBBackUpFile = @BackUpURL + @DBName + N'.BAK'
 SET @DBRestoreDataFile = @DataRestoreURL + @DBName + '.MDF'
 SET @DBRestoreLogFile = @LogRestoreURL + @DBLogName + '.LDF'
 
 RESTORE DATABASE @DBName FROM 
 DISK = @DBBackUpFile 
 WITH FILE = 1, 
 MOVE @DBName TO @DBRestoreDataFile, 
 MOVE @DBLogName TO @DBRestoreLogFile, 
 NOUNLOAD, REPLACE, STATS = 10
 
 SET @CompatLevel = N'ALTER DATABASE [' + @DBName + '] SET COMPATIBILITY_LEVEL = 100 ' --Update the Database compatibility level to SQL 2008
 + N'ALTER DATABASE [' + @DBName + '] SET RECOVERY FULL WITH NO_WAIT ' --Set the Database to Full Recovery
 + N'ALTER DATABASE [' + @DBName + '] COLLATE SQL_Latin1_General_CP1_CI_AS ' --Set Database Collation
 EXEC(@CompatLevel)
 
 FETCH NEXT FROM db_cursor INTO @DBName 
 END
 
 CLOSE db_cursor
 DEALLOCATE db_cursor
 DROP TABLE #tmp
 

--END SCRIPT

Hope this helps,cheers!

Thankfully there is a relatively easy solution, and the error could be avoided if this is a pre-migration step. TFS Admins will need to run a single command from the console on the TFS App Tier.

Please be aware, to use this command, you must have the required access rights to the TFS environment. Please see details https://msdn.microsoft.com/en-us/library/ms252504.aspx

General format of the command:
TFSSecurity /g+ groupIdentity memberIdentity [/collection:CollectionURL] [/server:ServerURL]

Example:
c:\Program Files\Microsoft Team Foundation Server 11.0\Tools\tfssecurity /g+ "Team Foundation Service Accounts" n:Domain\UserName ALLOW /server:https://TfsServer:8080/tfs

I certainly hope this helps, cheers!