Applepark Ltd

This question comes up again and again, and I can't remember where I found this information from all those years ago (it applied to Project 2003), but I wrote it down and seem to use it for most clients.  It's easily adaptable for Project Server 2007 - one day I'll write it properly and update it for 2007!

Project Server Security (P2003)

Overview

Project Server Security is complex. There are two types of permissions, five places to set them, and three conditions for each permission (allow/deny/soft deny). Appendix C & D of the Project Server Administrators Guide should be used for further reference.

Permissions

There are two types of permissions, data permissions (what data the user can see) and use permissions (what features the user can use). Each permission is not readily identified as to its type. Microsoft use the terms global for use permissions and category for data permissions. Additionally, they use the term Organisational Permissions, which are a set of permissions set for the whole organisation, and encompasses all of the use (global) permissions plus the 14 data (category) permissions.

The Roles of Security Templates, Groups & Categories

A security template is a predefined list of all the permissions (data & use). This list is ordered by permission area (admin, collaboration etc). Templates should ideally be named the same as groups.

A Group is a collection of users. A single user can belong to multiple groups. The use permissions are determined at the group level, and therefore group membership is the primary factor is determining the functionality that a user has within the system.

A Category is used to define the data permissions (hence Microsoft’s term, Category Permissions), i.e. what data can a user see, what actions can they perform on that data, and which views can they use to see the data. Categories are applied to groups, a single group can have multiple categories applied to it, and a category can be applied to multiple groups.

The permissions applied to each user is therefore a combination of the categories and the group membership.

Alloy/Deny

Three permissions are allowed for any permission. They are ALLOW, DENY, and soft deny. Soft deny (blank) is implicit if neither allow nor deny are selected. If a permission is set to deny in one place the system, then that becomes an absolute deny everywhere in the system, even if the permission has been set to allow elsewhere. If the permission is blank then the decision as to whether to allow or deny the permission is made elsewhere in the system.

Server Configuration Features

This is available in the PWA Admin tab, under server configuration, in the Select the Features That You Want to make Available to Users in Project Web Access section. Either set these use permissions to ALLOW or DENY. It is inappropriate to have blank here. The permissions lists here are the use permissions.

Templates

Use the templates to define a set of permissions for a particular role. The templates contain data and use permissions. Only change a use permission here to DENY if you want to deny a permission for a particular group, that has been globally allowed (via the Server Configuration Features) above. This is the 1^st opportunity to set permissions, so these should be set here to allow/deny as appropriate.

Categories

Categories define data permissions, and are further enhanced by data restrictors. Categories are assigned to groups, and a group may have more than one categories assigned to it.

Groups

The use permissions are set by the group. Assign the use permissions by applying the relevant template.

Users

Users are placed in groups. Never assign permissions to a user, troubleshooting the security will become too complex.

Recommendations

Security should be established in the following order

• Set universal allow/deny in server configuration
• Define the roles within the organisation, and create a security template for each role
• Define groups and assign data permissions using the template
• Define the categories, and assign them to the groups
• Assign resources to groups

See figure1. below for a graphical view of this.

Initial setup for Acme PLC

The following was set up on the live system for Acme PLC and used as a basis for security.   What I've done here is create categories called GROUP_NAME - See Everything.  Within the category set up you need to select the button that says - See all future Projects/Resources in the Database.

Templates

Resource managers - see everything

Execs - see everything

Portfolio managers - mod all (no admin)

Project managers - see everything

Team members - see everything except money

Categories

Resource managers - see everything

Execs - see everything

Portfolio managers - mod all (no admin)

Project managers - see everything

Team members - see everything except money

Groups

Resource managers -> CATEGORY = Resource managers - see everything

Executives -> CATEGORY = Executives - see everything -

Portfolio managers -> CATEGORY = Portfolio managers - mod all (no admin)

Project managers -> CATEGORY = Project managers - see everything - *When you make this assignment for the  category you need to enable the category permission to open all projects in the database, but not to save them*

-> CATEGORY = Project managers

Team members -> CATEGORY = Team members - see everything except money

During the lifetime of a project it is sometimes necessary to change the Project Manager (due to a leave of absence).  The process to do this has changed between 2003 and 2007. 

There are three areas to be concerned with

1.  Changing the Project Manager; Changing the status manager; replacing any PM resources.

Before you start on any of the above, make sure any updates to the project have been accepted, and that any changes have been fully published.  This results in lots of emails too, so worth making team members aware of what is happening.

1.  Change the Project Manager

This is done in PWA.  Select the project and Edit the Project Properties, and change the Owner to reflect the new Project Manager.

2.  If necessary, change the Status Manager.

As the new project manager, open the project in Project Professional.  Insert the Status Manager Column, and change the status manager for each task to be the new project manager. 

Note that it is not possible to change all the tasks at once, but it is possible to use CTRL-D to copy the changed status manager field down.

3.  If the old PM has assignments on the task, then these need to be changed too.  There are 3 scenarios for the task

a.  The task is completed and has zero remaining work - these tasks will not be effected.

b.  The task is partially completed, therefore has Actual Work and Remaining work values associated with it. 

c.  The task is not yet started.

The approach to replacing resources for all three scenarios is the same, and this should be done by using the Replace function within the Build Team from Enterprise Tool.

Here we are going to replace Ralls Kim with Allen Tony, by highlighting them both and clicking on the Replace button.  If Ralls Kim already has actual work associated with a task, then the following information box appears.

If a task is 100% complete, Project asks if you want to move the work to the new resource.  Note it doesn't tell you which task, and the correct answer is Cancel.

For Task 1 which already had actual work on it, Project assigns the remaining work to the new resource.  This is shown in the split lower split window for the Task 1.  (in our system here Allen Tony has limited availability so the task has been been split and automatically rescheduled).  The actual work completed by Ralls Kim has remained in place.

Finally, Save and Publish the project to make Team Members aware of their new responsibilities.

Introduction

This blog details how to move the WSS workspace between sub-sites. This may occur if a project is moved between programmes (setting up a programme is discussed in this  blog here http://appleparkltd.spaces.live.com/blog/cns!EB0688A7A6F04E1D!307.entry 

Process Overview

By default, Microsoft Office Project Professional 2007 creates a project workspace site on Windows SharePoint Services 3.0 when it publishes a project. When a sub-project creates a workspace, the user has the option of also creating the project workspace as a sub-site of the programme. This creates a hierarchy of sites as shown in Figure 1, where Programme1 has two sub projects (A & B), and Programme2 has two sub projects (C & D).

Figure 1 - Programme and PRoject Workspace relationships

If Project C is moved between programmes (due to reorganisation or setup issues) then the WSS site by default  not moved. The following steps show how to move the WSS site. The example will show Project C moving to be part of Programme1 (Figure 2).

Figure 2 - Project C has become part of Programme1

In order to move the Project C sub-site to sit beside Projects A & B it is necessary to perform the following steps.

1. Export the original site to a file

2. Create a new site as a placeholder for the migrated site

3. Import the original site to the new placeholder site

4. Change the site address to reflect the new site in the Manage SharePoint Sites page

5. Delete the original site

Export the original site to a file

On the Project server, open a command window and navigate to the following location

C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN

Type in the following command

stsadm –o export –url <url> -filename <filename>

The <url> is the url of the site that you wish to export and the filename is the output file.

When the command has finished there should be a file called <filename>.cmp in the directory.

Create a new site as a placeholder

Navigate to the programme workspace where the new project is to be located, and create a new sub-site from the site actions tab. The site that you create must be a Project Workspace, and for ease, the URL name should match the original URL. Finally check the radio button so that the site is not displayed in the quick launch area.

Figure 3 - Create the new placeholder site

Verify that the new site has been successfully created by accessing it.

Figure 4 - Verify The new site is created – Note the Breadcrumb showing Programme1

Figure 5 - The three subsites now show under the Programme1 workspace

Import the original site into the new site

Once the new site has been created, it is time to import the exported data from the original site. This is a similar process to the original export.

On the Project server open a command window and navigate to the following location

C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN

Type in the following command

stsadm –o import –url <url> -filename <filename>

The <url> is the url of the site that you wish to import and the filename is the input file.

When the command has finished, refresh the new project workspace site and check that the new content exists.

Figure 6 - Note the imported content on the new site

Change the site address to reflect the new site in the Manage SharePoint Sites page

In order to link the new site to the project, it is necessary to change the site address. In PWA, navigate to Server Settings | Project Workspaces. Select the relevant workspace and click on Edit Site Address. Modify the address so that it points to the new Project Workspace within the correct programme.

Figure 7 - Modify the site address to reflect the new site

Once the site address has been modified, click on Synchronise to update the permissions on the new site.

Delete the original site

The original site still exists and so it needs to be deleted in order to remove it from the original programme. Navigate to the site, and within Site Actions | Site Settings and then Delete this site. Caution, ensure that you are deleting the right sub-site, and not the programme site.

Introduction

Okay, so there is no such thing as the perfect schedule, but there are good and bad practices for creating a schedule using Microsoft Project. Some other tools don’t allow some of these bad practices, but Project just goes ahead and lets you do it – this allows lots of flexibility but if you’re not exactly sure what you are doing then it can lead to some “interesting” results. So here’s my list of best practices for using Project, and this might get you a little closer to the perfect schedule. There are a couple of tools which will help with some integrity checking of project plans, either for Project Server or for the client, post a comment or email me if you want further details and prices.

Learn the formula that Project uses to schedule

Project uses the following formula for calculating the schedule; Work = duration * units. Learn it, understand it, do the algebra and enjoy it! Without this understanding you will always be frustrated with Project.

Set the Project Start or Finish date

Instead of placing a constraint date on the 1^st task in a project to define when the project starts, set the Project Start date or Finish Date as required.

Figure 1 - Set the Start or Finish date of the project

All tasks should be linked

Following on not linking summary tasks, every task such have both a successor and predecessor, except of course the last task and first task. Thinking about these relationships help you identify the relationships between the tasks.

Minimise the use of constraint dates

Using constraint dates stops Project from dynamically scheduling the project schedule. Instead, learn to use the different task types and scheduling options, including FS, SS, FF and SF types, plus lags times (in terms of days, % of the task durations and –ve / +ve lags). Sometimes it really is necessary to use constraint dates, (e.g. Must Start On), but learn how and when to use them, and read and understand the scheduling messages that Project gives you.

Note that if you manually type in a Start date, or drag a task on the Gantt Chart, then a constraint type of Start No Earlier Than is applied to the task.

Figure 2 - Define the Task Dependency and lag

Instead use deadline dates

Deadlines are very useful, but not often used – so instead of setting a constraint, set a deadline instead, and project will warn you if you’re going to miss the deadline.

Figure 3 - Set the deadline and project will tell you if it won't meet it!

Learn about task types

There are three task types, fixed effort (the default), fixed work and fixed duration. If you don’t understand what they mean, then I suspect you don’t understand the scheduling formula of Work = duration * units either.

Milestones tasks should not have resources assigned to them

Again, I see this with customers and it really is bad form. Milestones should identify a point in a project (often a deliverable, e.g. “code complete”), and hence don’t need resources assigned to them.

Don’t assign resources to summary tasks

In fact, don’t assign anything (costs, resources, % complete etc) to summary tasks. Summary tasks are just that, summaries of the tasks below, so if you manually change any of the values then the values of the summary tasks won’t make sense, so don’t change them!

Don’t link summary tasks

How many times do I see customer’s doing this? It won’t cause corruption if you do, it’s just that really you should only link actual tasks, rather than summary tasks. So instead of linking summary tasks (which are often phases in a project) consider creating a milestone exit task and a start task for each phase.

Project Auditing tools

There are various commercial auditing tools available. The following screen shots give you an idea of their potential.

Figure 4 - Server based auditing tool

<dry - again!>

Gee'd on by too many nights in hotels, I started briefly messing around with Analysis Services, and I started thinking that there must be so much you can do with this tool than the basics that you get out of the box. 

My main reason for this was that I wanted to get a view of availability in terms of days (rather than the default hours) for specific resources, and in particular, I was interested in people who are over allocated, i.e., have a negative availability.  So I'll show you how to build this type of view, though once you get into it, you'll learn a whole lot more, just as I have.

So, start off with a blank view using the MSP_Portfolio_Analyzer cube.

Then, making sure you have the tool bar showing, select the Calculation button and create a new calculated field.

The following formula calculates availability (you can put this as a calculated field in the cube too) and then divides it by 7 (the number of hours in each day as defined in our Enterprise calendars)  

([measures].[capacity] - [measures].[work])/7

Click Change and the value will appear in the data section of the Pivot Table.

To clear up the decimal points, click on the format tab and type in #,# in the Number field, this rounds the days to the nearest whole day.

and puts in the separator for the thousands...

Now, add the resources as row fields.  Obviously you may want to apply a filter, probably by RBS, or, if you've set one up, OBS or similar.

Adding a time dimension is required so that we can view over allocations over the coming weeks/months.

To highlight the resources with negative capacity, we can format the cells and also group them by sorting them in either ascending or descending order.

All over allocated resources are grouped on the pivot table (and consequently any pivot chart).

Further more, we can drill into the month and get weekly details, which can be graphed too, so we begin to see by how many days each resource is over allocated in each week.

Enjoy,  Ben.