Nitish Nagpal brings us this story of a recent support case.
One of my customers reported that suddenly a build controller that was previously functioning had stopped working and was unable to connect to a particular collection in the TFS instance. Specifically now the Build controller no longer connected to TFS and errors like the following were found in the Event Log: Service 'Default Controller - vm-747c-5d5c' had an exception:
Exception Message: TF277005: Access denied. domain\buildservice account needs the Use build resources privilege to perform this action. For more information, contact the Team Foundation Server administrator. (type TeamFoundationServiceException)
Exception Stack Trace: at Microsoft.TeamFoundation.Client.TeamFoundationClientProxyBase.ProcessHttpResponse(HttpWebResponse response, Stream responseStream, WebException webException, XmlReader& xmlResponseReader)
at Microsoft.TeamFoundation.Client.TeamFoundationClientProxyBase.ExecWebServiceRequest(HttpWebRequest request, XmlWriter requestXml, String methodName, HttpWebResponse& response)
at Microsoft.TeamFoundation.Build.Machine.SharedResourceWebService.ReleaseAllLocks(String requestedBy)
at Microsoft.TeamFoundation.Build.Machine.BuildControllerService.InitializeServiceHost(ServiceHost serviceHost, X509Certificate2 serviceCertificate, BuildListenerExtension buildListenerExtension)
Inner Exception Details:
Exception Message: TF277005: Access denied. EUR\username(build service account) needs the Use build resources privilege to perform this action. For more information, contact the Team Foundation Server administrator. (type SoapException)
Exception Stack Trace:
We found that the TFS Valid users had an explicit denial for build resources.
When that was unchecked, it started working.
Additional Points: The other things to check is the collection level permission and make sure that managed build resources, use build resources and view build resources are checked