Team Foundation Server on a Domain Controller

If you choose to install Team Foundation Server on a domain controller (less than optimal), you’re going to have some issues. The one I’d like to address here is this one, which happens when viewing reports (including through the team project portal site):


This by design and happens because members of the Builtin Users group on a domain controller include Domain Users. Members of this group do not have the right to logon locally (SeInteractiveLogonRight). The Reporting Logon Account (for example, TFSReports) is just a regular domain user account. As a result, the default behavior on a domain controller prevents it from impersonating the user requesting the report. For more information, see

To get around this issue, you can just logon as an Administrator and add the needed right to that account:

C:\> ntrights -u TFSReports +r SeInteractiveLogonRight

Where TFSReports is the reporting data reader account specified during Team Foundation Server setup.

Update - you can find ntrights.exe in the Windows Server 2003 Resource Kit Tools.

Comments (5)

  1. Hammad says:

    You need to change the policy on the domain controller in which you will allow the specified users (user you are using to view the portal of your project) to logon locally. I hope it will work.

  2. RobCaron says:

    Yes, you can either change the policy for all users, or grant that specific right to that one account. The latter is probably the more secure approach.

  3. I know I probably shouldn’t be this excited, but I’ve just installed VSTS B3 into a single VPC image, and it worked first time!! Still a couple of funnies, reports don’t seem to be working doesn’t look fatal, probably a…

  4. Winmai says:

    I have observed an an online installation of TFS 2008 and together with this article, I assumed that TFS 2008 can be installed in a domain controller. However when I tried to install from dvd, I get:


    Team Foundation Server is not supported on a domain controller. "

    I know this is not possible with TFS 2005.

    I have a new server with Windows Server 2003 Enterprise. Everything is setup i.e. Active Directory, DNS, DHCF, IIS, Sharepoint v2 and v3 etc. All I need now is to install TFS 2008.

    Please tell me this is possible.

    Thank you.

  5. RobCaron says:

    You cannot install Team Foundation Server 2008 on a domain controller. See:…/ee248700(v=vs.90).aspx

Skip to main content