Even Administrator got 403 error on task edit page of PWA

[MXE02332]

I don't know why I get the plain 403 access denied error on Project Web
Access 2007. Please give me some suggestions.

I installed Project Server 2007 and SQL Server 2005 Standard Edition on one
Windows 2003 Standard Server SP1 machine which participates in Active
Directory domain.

After finishing the installation with the help of Microsoft's step by step
guide, I logged on PWA by the Project Server admin and made several PWA users
with AD synchronization function. I added some more users not by using the
synchronization but based on AD's accounts.

I added one of the users to Project Managers group and other users to
Project Members group.

Then I logged on a PC as the project manager user and created a project file
with Project Professional 2007 client, assigned some tasks to some of the
project member PWA users created above, saved and published the project file
to Project Server.

Then I logged on the PC with one of the project member user and open PWA top
page. Naturally I saw some new tasks assigned. I opened the task list page
and click one of the assigned task to edit the task properties, then I got
the non-customized plain 403 access denied error page.

But I can add a memo to any of the assigned tasks and I can see the project
overview page. Most of PWA functions are all right. Only the create-new-task
page and the edit-task page are not available because of the plain 403 error
page.

I switched to Project Server admin and added this project member user to PWA
Administrators group. I switched back to this project member user which is
now one of the PWA administrators, but I got the same plain 403 error.

I found the plain 403 error mainly caused by the misconfiguration of IIS
6.0. So I logged on the server and granted anonymous access to the default
web site, i.e. PWA site. I know this configuration change is non-sense
because PWA should be accessed by AD authenticated users. But I did it just
for trying to find the cause of 403 error.

Again I logged on a PC with the project member with PWA administrator
privilege mentioned above and click one of the assigned tasks. And I got the
same non-customized plain 403 access denied page of IE 6.0 again. Nothing
changed.

Why do all these strange things happen? Any suggestion will be helpful.
Thank you in advance!

MXE02332

 

[James Fraser]

I don't know why I get the plain 403 access denied error on Project Web
Access 2007. Please give me some suggestions. ....[details omitted]...

Why do all these strange things happen? Any suggestion will be helpful.
Thank you in advance!

MXE02332

I have run into a very similar issue, possibly identical, and have an
open case with Microsoft regarding this. I did find a couple of
effective work arounds for my problem.

1) When any user with Administrator permissions for Windows on the
server itself (not just PWA permissions) accesses the same error
pages, the error disappears for all users for approximately 8 hours.
-or-
2) Removing the .Net 2.0 update KB928365. (Use Add and Remove Programs
control panel and make sure to check "Show updates") This seems to be
related to the root cause, and removing this update fixed the problem
for us more permanently. MS does not recommend leaving this update
off, that's why our support case is still open.


I'm curious if these work for you...
James Fraser

 

[MXE02332]

Dear James,

Thank you very much for your information!

In our case, your 1) doesn't work. I configure PWA with the user
who has both the server's local Administrator privilege and Domain Admin.

In addition, we never get the plain 403 error page when I assign some
tasks to the PWA's system admin and open the task-edit page
although another PWA Administrators group user, who has neither
the server's local Admin or Domain Admin, gets the 403 error.

And 2) has nothing to do with our server because KB928365 is not
applied to our server.

Regards,

MXE02332

I don't know why I get the plain 403 access denied error on Project Web
Access 2007. Please give me some suggestions. ....[details omitted]...

Why do all these strange things happen? Any suggestion will be helpful.
Thank you in advance!

MXE02332

I have run into a very similar issue, possibly identical, and have an
open case with Microsoft regarding this. I did find a couple of
effective work arounds for my problem.

1) When any user with Administrator permissions for Windows on the
server itself (not just PWA permissions) accesses the same error
pages, the error disappears for all users for approximately 8 hours.
-or-
2) Removing the .Net 2.0 update KB928365. (Use Add and Remove Programs
control panel and make sure to check "Show updates") This seems to be
related to the root cause, and removing this update fixed the problem
for us more permanently. MS does not recommend leaving this update
off, that's why our support case is still open.


I'm curious if these work for you...
James Fraser

 

[Jonathan Sofer]

James,

I have a ticket opened with MS on this exact issue and they found your
ticket when doing research and asked us to try removing the security update.
After removing the security update, the issue seemed to go away. I noticed
the security update was re-installed on the server the very next day due to
automatic updates being enabled. However, the issue seemed to go away for a
few days until other stange things happened on our production environment
and we had to re-provision the top PWA site. After doing that, the issue is
now back. No word from Micrsoft since then. I am afraid to try and remove
the security update as it might have caused the production issues we ran
into a few days afterwards.

Also, we do not have this issue on our development environment and the
security update exists there the same as production.

Jonathan

I don't know why I get the plain 403 access denied error on Project Web
Access 2007. Please give me some suggestions. ...[details omitted]...

Why do all these strange things happen? Any suggestion will be helpful.
Thank you in advance!

MXE02332

I have run into a very similar issue, possibly identical, and have an
open case with Microsoft regarding this. I did find a couple of
effective work arounds for my problem.

1) When any user with Administrator permissions for Windows on the
server itself (not just PWA permissions) accesses the same error
pages, the error disappears for all users for approximately 8 hours.
-or-
2) Removing the .Net 2.0 update KB928365. (Use Add and Remove Programs
control panel and make sure to check "Show updates") This seems to be
related to the root cause, and removing this update fixed the problem
for us more permanently. MS does not recommend leaving this update
off, that's why our support case is still open.


I'm curious if these work for you...
James Fraser

 

[MXE02332]

I've found a meaningless workaround for this issue by myself.

If I add the PWA users who get 403 error to local Administrators group
of PWA server, they can't get 403 error any more during editing assigned
tasks.

We can summarize this as follows.

"Only the PWA server's local Administrators can edit the tasks
assigned to them on PWA 2007."

Of course, I can't add all PWA users to the server's local Administrators
group
because this means all of them can configure the PWA server freely via
the remote desktop connection. So this is a meaningless workaround.

IIS 6.0 on PWA server runs with Local System Account.
The default web site for PWA runs with Integrated Windows Authentication.

I think these are the recommended settings.

Why do only 'Edit Task' and 'Create New Task' functions on PWA give 403 error?

MXE02332