Tuesday 26 January 2010

EPM2007 – Preventing Users from Modifying PWA Pages and Personalization

Ever got a call from a user one morning to say that the data on PWA page is not showing i.e. only a blank page shows with no error messages. Or, the PWA theme has been changed! Puzzling….you investigate and get the same result, say for example the REMINDERS are not showing on the Home Page within PWA! You investigate and determine that the the webpart was removed by someone. But WHO! You are the only administrator. No one else is forthcoming to state that they have done something.  Could it be someone external?

If you are an EPM Application Administrator or PMO and you have encountered this situation and/or concerned that this could happen in your deployment, then read on.

Where to start looking?

Determine what the Project Managers or Team Members can and can’t do. Log in with role-based test user accounts, if necessary. Within PWA Home Page, navigate to Site Actions and determine if the user is able to EDIT PAGE for example. See fig below.

PWAPageChange_Global

(click picture to enlarge)

Based on the above fig, the user is able to create, modify PWA pages by removing and adding webparts within the page and edit site themes, affecting all other PWA users within the environment.

Users belonging to Project Managers group within Project Server 2007 will be able to do this by default!

The next thing you may wish to check for is the ‘Personalization’ capability i.e. changes that are local to the user and do not affect the other users. See fig below. 

PersonalizePage 

Where to make changes to default PWA Site Permission settings?

To make changes to the default permission settings, navigate to PWA > Site Settings and select Advanced Permissions.

PWAUserGroupAdvancedPermission 

Next, from the Settings dropdown, select Permission Levels.

PWAUserGroupAdvancedPermission_Settings

Here you will see the User Groups at PWA root site site level. The one that you need to review and modify is the ‘Project Managers’ user group. See highlighted in figure below.

SecurityGroups

Select this user group and make following changes;

Uncheck the Manage List check box.

ManageLists

Next, uncheck the options for ‘Add and Customize Pages’, ‘Apply Themes and Borders’ and ‘Apply Style Sheets’.

AddAndCustomizePages

Once this is done, the Project Managers will not see the ‘Site Actions’ Tab.

NoSiteActionsCapability 

Whereas before they saw ‘Create’, ‘Edit Page’ and ‘Site Settings’ within Site Actions as in the first fig above.

Where to make changes to default PWA Personal Permissions settings?

If you want to further restrict users from making personal changes. Then uncheck the Personal Permissions options for PWA site user group. See fig below.

AdvancedPermission_Personal 

This, in my view, is optional. I would personally leave this unchanged. The users have the option to Show Shared View or Reset Page Content if they are not happy with their personal page changes.

ShowingSharedView&ResttingContent

Considerations for making changes to default PWA Site Permissions in an existing system

Ideally, the above changes should be considered during the planning phase and modified before the users are added to the Project Server User Groups. If, however, you decide the make the above changes in an existing deployment where users are already added to Project Server User groups, you will need to take the following action;

  • Re-apply Project Server security by first removing and adding back users into the affected Project Server user group, in this case it is the Project Managers user group. Ensure you save changes after removal and addition of users back into group(s).

As always, document and test any changes thoroughly on a development environment before making changes to the live system. A virtual PWA instance/environment is sufficient for this purpose.

Hope this helps you keep a tighter control of your EPM environment.

Note: Also read how Project Server Security Groups map to SharePoint Security Groups

Tuesday 19 January 2010

SQL Server 2008 CU9

If you have SQL Server 2008 in your EPM/SharePoint environment, you may interested in the latest SQL 2008 CU9. Review the fixes in particular for Analysis Services and SQL Reporting.

Hotfix download is available
Hotfix Download Available
View and request hotfix downloads

Cumulative update package 9 for SQL Server 2008

Monday 18 January 2010

EPM2007 – What is my system patch level? download latest ‘complete’ package

Find out if you have the latest patches. Compare version numbers against figure below. Download single ‘complete’ package containing all latest updates?

EPM2007 Updates

(click picture to enlarge)

- How to verify EPM updates and patch level?

Hope this helps.

EPM2007 – Why cant I see Project Custom Attributes in OLAP Cube Fields List?

I recently came across some odd behaviour in Data Analysis views. I could not see some project attributes in the fields list within the MSP_Portfolio_Analyzer cube. There was no explanation. I ensured that the attributes were text fields with lookup tables and no multi-value selection option was checked. The issue was fixed by ‘tricking’ the system that a hierarchy exists on the associated lookup table values and then re-instating the original hierarchy which was a flat structure. Here are the general steps;

1. Select the custom attribute look up table. The one that is not appearing in the fields list for MSP_Portfolio_Analyzer cube.

EPM2007_Cube_FieldsListIssue_1

(click picture to enlarge)

2. Insert a mask for level two. Note: originally a flat single level structure as in fig above.

3. Insert a new row in the look up table value list at the top (give it the same name as lookup table name) and out-dent the others (existing values). Remember to NOT delete the existing values.

EPM2007_Cube_FieldsListIssue_2 

4. Save the lookup table

5. Build the cube

6. Check the field list to ensure the custom attribute exists

EPM2007_Cube_FieldsListIssue_3 

7. Re-state the lookup table value as before i.e. indent and the existing values and then remove the newly added row at the top.

8. Build the cube

9. Check the field list to ensure the custom attribute exists

I am doing some further tests to reconfirm the resolution. I will update this post if there is any further information to add.

EPM2007 – Cube Building Error message ‘GetJoinForCustomFieldDimension’

I recently came across an issue whereby the Data Analysis Cube build service failed with the following message;

‘Failed to build the OLAP cubes. Error: Invalid call to GetJoinForCustomFieldDimension. Cannot join "Task Non Timephased" fact with a custom field of entity Assignment’

The cube was building fine up to a point when some attributes where updated in the system and assignment dimensions where updated. This caused the reporting database to refresh and the subsequent Cube Build process to fail. I resolved the issue by following these steps;

  1. Restarted the SQL Server (also housing Analysis Services). The Temp DB had ‘bloated’
  2. Remove all the cube dimensions and measures via Server Settings > Cube > Configuration.
  3. Save Cube Configuration
  4. Add back the required cube dimensions and measures.
  5. Save Cube Configuration
  6. Rebuild the Cube

Voila! Back to normal again.

Note: I did go a couple of steps further after step (1) above to manually delete the Analysis Services Database (this gets re-created automatically by cube building service) and also re-created the OLAP Repository SQL Database. I just wanted to start clean!

Hope this helps others in the same boat.