Support Postmortem: Suddenly a build controller (that was previously functioning) has stopped

  • Article

Nitish Nagpal brings us this story of a recent support case.

--Trevor

 

PROBLEM DESCRIPTION
=====================

One of my customers reported that suddenly a build controller that was previously functioning had stopped working and was unable to connect to a particular collection in the TFS instance. Specifically now the Build controller no longer connected to TFS and errors like the following were found in the Event Log:  Service 'Default Controller - vm-747c-5d5c' had an exception:

Exception Message: TF277005: Access denied. domain\buildservice account needs the Use build resources privilege to perform this action. For more information, contact the Team Foundation Server administrator. (type TeamFoundationServiceException)
Exception Stack Trace: at Microsoft.TeamFoundation.Client.TeamFoundationClientProxyBase.ProcessHttpResponse(HttpWebResponse response, Stream responseStream, WebException webException, XmlReader& xmlResponseReader)
at Microsoft.TeamFoundation.Client.TeamFoundationClientProxyBase.ExecWebServiceRequest(HttpWebRequest request, XmlWriter requestXml, String methodName, HttpWebResponse& response)
at Microsoft.TeamFoundation.Build.Machine.SharedResourceWebService.ReleaseAllLocks(String requestedBy)
at Microsoft.TeamFoundation.Build.Machine.SharedResourceExtension.ReleaseAllSharedResourceLocks()
at Microsoft.TeamFoundation.Build.Machine.BuildControllerService.InitializeServiceHost(ServiceHost serviceHost, X509Certificate2 serviceCertificate, BuildListenerExtension buildListenerExtension)
 
Inner Exception Details:
 
Exception Message: TF277005: Access denied. EUR\username(build service account) needs the Use build resources privilege to perform this action. For more information, contact the Team Foundation Server administrator. (type SoapException)
 
Exception Stack Trace:

 
Cause:
======
We found that  the TFS Valid users had an explicit denial for build resources.

 

Resolution
========
When that was unchecked, it started working.

Additional Points: The other things to check is the collection level permission and make sure that managed build resources, use build resources and view build resources are checked