What to do when TfsQuiesce fails with "No associated service account for role TFSEXECROLE" error

  • Article

When installing a service path on Team Foundation Server one of the first things that needs to happen is that TFS is "quiesced" - which basically means "to make quiet" - i.e. it's running but it's not accepting new client connections.  The tool that does this during the SP installation is called 'TfsQuiesce.exe". 

This blog post is to explain what you can do when you see the following in your log file after a failed upgrade:

TFSQuiesce - Team Foundation Server Maintenance Tool
Copyright (c) Microsoft Corporation. All rights reserved.

Using workflow file from location exe.
Executing workflow 'Quiesce DT'...
Disabling SQL Jobs for databases TFSActivityLogging,TFSBuild,TFSIntegration,TFSVersionControl,TFSWorkItemTracking,TFSWorkItemTrackingAttachments,TFSWarehouse
Blocking service account from accessing database TFSActivityLogging
No associated service account for role TFSEXECROLE.
Executing workflow 'Unquiesce DT'...
Enabling SQL Jobs.
Unblocking service account from accessing database TFSActivityLogging
Unblocking service account from accessing database TFSBuild
Unblocking service account from accessing database TFSIntegration
Unblocking service account from accessing database TFSVersionControl
Unblocking service account from accessing database TFSWorkItemTracking
Unblocking service account from accessing database TFSWorkItemTrackingAttachments
Unblocking service account from accessing database TFSWarehouse

Workflow 'Quiesce DT' failed! ExitCode = 8000.
10/31/07 12:17:15 DDSet_Status: Process returned 8000
10/31/07 12:17:15 DDSet_Status: Found the matching error code for return value '8000' and it is: '29206'
10/31/07 12:17:15 DDSet_Error: 8000
10/31/07 12:17:15 DDSet_CARetVal: 29206
10/31/07 12:17:15 DDSet_Status: QuietExec returned 29206

Notice the bolded line "No associated service account for role TFSEXECROLE" - this is the key line.

This error is indicating is that one or more of the databases have no members in the TFS exec role.  The reason we are running this check at all is to ensure that we are not running the upgrade as the service account user.  Let’s start by figuring out if this is a problem with all seven TFS databases or just one of them.

Run the following SQL statement 7 times – each time changing the “use TfsVersionControl” to one of the other TFS databases:

 use TfsVersionControl

SELECT  dpMember.name
FROM    sys.database_principals dp
JOIN    sys.database_role_members drm
ON      drm.role_principal_id = dp.principal_id
JOIN    sys.database_principals dpMember
ON      dpMember.principal_id = drm.member_principal_id
WHERE   dpMember.Type = 'U'
        AND dp.name IN ('TFSEXECROLE')

I expect one or more of the result sets to be empty. 

Ultimately the role can’t be empty.  When you find the database(s) with the empty TFSEXECROLE role you should add the appropriate service account user to the role for that database(s).

Re-run the SQL snippet to ensure the fix was made properly and now running the installation should past this error.