| The Manage Users and Groups function is one of the most commonly accessed administrative functions. PWA users can be added, modified, or deleted, and users can be placed in security groups to set the features and data an individual user has access to. From this interface, groups can also be added, modified, or deleted, and user accounts can be merged to create a single user account with all the attributes of the current user but with data from both user accounts. Before using any of the Manage User and Groups functions under Admin, make sure that you understand the Project Server security model.  PAGE 143.
Managing Users All PWA users are accessible through the administrative function Manage Users and Groups. You need to access this function when users change Project Server roles or when account information changes, as shown in Figure 19.2. Figure 19.2. The Users page contains all functions to add, delete, or change users. 
Adding a User In the Project Server environment, there are three ways to add users to PWA: Active Directory Use Active Directory synchronization. Enterprise Resource Pool Add a user as a resource in the Enterprise Resource Pool. This is the most efficient way to add a user if you are not using Active Directory synchronization. When you do add a resource to the pool, Project Server automatically adds the resource as a user in the Team Member role in PWA. When you do this, make sure that you also include at least the Domain\User ID in the Windows Account and the email address in the Email data fields for the resource(s). Then, all you need to do is change the role of the resource if it is different from the default Team Member. Manage Users and Groups of the Admin tab You can add users directly via this function. This may be used to add a user who will not be a resource on a project schedule, such as a client, executive, or someone who needs to use only the collaborative features of PWA.
NOTE If you add a user or resource via the Add User function in PWA and run Active Directory synchronization, Active Directory actually removes the user if it does not find the username in Active Directory.
To add a user, follow these steps: 1. | Under the Admin tab select Manage Users and Groups.
| 2. | Under Add, Modify, and Delete in the side pane select Users.
| 3. | Click Add User from the menu. The Add User page appears, as shown in Figure 19.3.
Figure 19.3. The Add User page allows you to configure new system users. 
| 4. | Select an authentication method for this user and add the information as required.
NOTE Users added directly in the Add Users page are not automatically added to the Enterprise Resource Pool. | 5. | Select the groups that the user should belong to and click Add. Users can be in one or multiple groups.
NOTE The user will be a member of the groups selected and inherit the permissions in the group(s). Categories should be associated with security groups and should not be assigned directly to users. | 6. | Click Save Changes.
|
Modifying Existing Users At times, you need to change information about a user, such as the user's email address, domain, or account status. To do so, you use the Modify User function: 1. | Under the Admin tab, select Manage Users and Groups.
| 2. | In the side pane under Add, Modify, and Delete, select Users. The Users page, which consists of a drop-down list with all PWA users and user properties, appears. To filter and sort by user, authentication type, and status, you can view users in a grid, as shown previously in Figure 19.2.
NOTE The grid may require several minutes to load if you have many users. NOTE The grid can be sorted by last connected to view PWA access, providing useful information on which users are actively using the system. | 3. | Highlight the user in the grid or select the user from the drop-down list and click Modify User from the menu.
| 4. | On the Modify User page, as shown in Figure 19.4, make the necessary changes and click Save Changes.
Figure 19.4. The Modify User page allows you to configure settings for the selected user. 
|
NOTE If the PWA user is also in the Enterprise Resource Pool, changes to the user or resource are reflected in both PWA and the Enterprise Resource Pool data.
NOTE The Clear User AD GUID check box is enabled only on the Modify User page for Project Server users who use Windows authentication and only when the user has an associated Active Directory Globally Unique Identifier (GUID). Clearing the Active Directory GUID prevents any further updates for the particular user from Active Directory.
TIP Do not set global permissions on an individual user or add users directly to categories through this page.
Deactivating Existing Users There are several ways to deactivate a user in PWA: Active Directory use Active Directory synchronization. If the user is removed in Active Directory, it marks the user as Inactive. Enterprise Resource Pool Mark the user as Inactive. Manage Users and Groups of the Admin tab Under Modify User, select Inactive in the Account Status field. Manage Users and Groups of the Admin tab Use the Deactivate User function.
To use the Deactivate function, follow these steps: 1. | Under the Admin tab, select Manage Users and Groups.
| 2. | Under Add, Modify, and Delete in the side pane, select Users. This displays the Users page, which consists of a drop-down list with all PWA users and user properties. To filter and sort by user, authentication type, and status, you can view users in a grid, as shown previously in Figure 19.2.
| 3. | Highlight the user in the grid or select the user from the drop-down list.
| 4. | Click Deactivate User from the menu.
|
NOTE Deactivating a user inactivates the user's account so that it can no longer be used to log on to the computer running Project Server 2003. User accounts, when deactivated, are not actually deleted from the Project Server database. If the user is an enterprise resource, he will no longer be available in Build Team.
Merging Two User Accounts It is possible that two accounts can be created for the same person. This often happens when an organization first starts using Project Server and does not yet have good processes or standards to ensure unique account creation. You can merge two such accounts to create one account for a user. NOTE To minimize the possibility of two accounts being created for a user, create a standard to allow only the administrator to create new accounts.
To merge two user accounts, follow these steps: 1. | Under the Admin tab, select Manage Users and Groups.
| 2. | Under Add, Modify, and Delete in the side pane, select Users.
| 3. | Highlight the user account that you want to merge another user into from the grid or select the user from the drop-down list and click Merge User Accounts from the menu.
| 4. | On the Merge User Accounts page, select the user you want to be merged.
NOTE You should merge user accounts only if they refer to the same person. If you try to merge user accounts that have been assigned the same tasks or status reports, you could have data conflicts. | 5. | Click Save Changes.
|
NOTE This creates a single user account with all the attributes of one user but with data from both user accounts.
Managing Groups Groups contain security rules defined for a particular role. Users are added to groups to simplify the maintenance of user permissions. The Groups page allows you to create, modify, and delete groups, as shown in Figure 19.5. Figure 19.5. The Groups page contains all functions to add, delete, or modify groups. 
Creating a Group You will want to create groups when you have a customized role you want to use in your organization, or if you want to have your organization's own group roles, based on the default groups established in Project Server. Before creating a group, make sure that you define and document the functions and data you want the group to use and see to decide what permissions the group should have and what category should be attached to the group. NOTE As described in Chapter 8, "Establishing Security Model Settings," you might create a security template for the role prior to creating the group.
When you are ready to create a new group, follow these steps: 1. | Under Admin tab, select Manage Users and Groups.
| 2. | Under Add, Modify, and Delete in the side pane, select Groups. This displays the Groups page, which consists of a grid containing all groups, as shown in Figure 19.5.
| 3. | Click Add Group from the menu. The Add Group page appears, as shown in Figure 19.6.
Figure 19.6. The Add Group page. 
| 4. | Enter the name and description for the new group in the fields provided. Enter the Active Directory group in the provided box if using Active Directory synchronization.
| 5. | Select users to add to the group by highlighting the username in the list of available users and clicking Add.
NOTE Users can be added at any time using the Modify Group or Modify User option. | 6. | Select the categories from the available categories and click Add.
NOTE As described in Chapter 8, the best method for creating a new group is to develop the custom category the group will use prior to actually creating the group via the Admin function. That way, after you create the group, you can attach the proper category (which indicates what data the group can see) to the group. | 7. | For each category added in Step 6, highlight the category name in the Selected Categories list and set the permissions this group will have by checking the Allow box or applying a group security template.
NOTE Review and set category permissions for proper settings. Each category may require different security permissions. | 8. | Set the Global permissions by selecting the security template from the drop-down list and clicking Set Permissions with Template.
| 9. | If you want to use a digital dashboard, Under Digital Dashboard Link: Set the Default Digital Dashboard Link for Members of This Group, and enter the path to the portal site URL for this group.
| 10. | Click Save Changes.
|
NOTE If changing permissions on a group, first modify the security template for the role prior to applying the permissions to the group.
Modifying an Existing Group You may need to change the permissions, categories, or users for a group. Be careful making any changes. It's best to test the change for the group to make sure that you did not inadvertently take away or give a permission you did not intend. To modify a group, follow these steps: 1. | Under Admin tab, select Manage Users and Groups.
| 2. | Under Add, Modify, and Delete in the side pane, select Groups. The Groups page, which consists of a grid containing all groups, appears, as shown previously in Figure 19.5.
| 3. | Select the group to modify.
| 4. | Click Modify Group from the menu, and the Modify Group page appears.
| 5. | Make the required changes to the group and Click Save Changes.
|
Deleting an Existing Group At times, you may need to delete a group that you created. If you do, make sure that you add the users who are in the group to be deleted to another group before deleting it. Those users will not be able to use PWA if they are not associated with another group. Follow these steps to delete a group: 1. | Under Admin tab, select Manage Users and Groups.
| 2. | Under Add, Modify, and Delete in the side pane, select Groups. The Groups page, which consists of a grid containing all groups, appears, as shown previously in Figure 19.5.
| 3. | Select the group to delete.
| 4. | Click Delete Group from the menu. In the confirmation dialog click Yes.
|
NOTE The default groups created at installation cannot be deleted.
|
