Is there a way to find customized permissions in TFS - tfs

Question

We are planning to move our Team Foundation Server server to a new domain, and as such any customized permissions will need to be updated/corrected.
I was wondering if there was a tool, or some sample code I could use to scan through TFS files and folders (as seen in Source Control Explorer) to find permissions that are different from the default.
Note that unfortunately, we are still using TFS 2010.
What I would like is to get or build a summarized list saying at this path, security was changed for User X to a, User Y to b, etc. and if inheritance was turned off. If a path did not have any security changes, then I would prefer it if it is not included in the report. I can build code to strip that out if necessary as long as the report is in an editable format (e.g. csv, xml, html, txt)
I am quite willing to create the tool myself, I am just unsure where to start. It seems like the libraries for this are so large and often these things are not well documented. If I create this, I will share what I can.
Thank you

Answer 1

You may try Team Foundation Sidekicks. Team Foundation Sidekicks includes Permission Sidekick, which provides the following features:
Select user whose effective permissions are to be reviewed
View Team Foundation Server groups user is a member of (Windows
domain groups are not included)
View user's global TFS server permissions
Select Team project to view project specific effective permissions
View user's Team project's permissions
Select project's version control folder/file and view effective
version control permissions for that item (including indication
whether permissions are inherited or explicitly set)
Select project's area and view effective permissions for that area
For every effective permissions display, view a reason for every
effective permission setting - namely, for which groups Allow/Deny
permissions are set and therefore what effective permission is based
on

Answer 2

I ended up writing code to do this. I'm sorry it took so long to post this.
It creates a text file that specifies the security on every item in TFS that has explicit security. It may give more information that needed, but worked well for my needs.
If you make use of this, you should replace "TFSServer" with your actual server name, and "CollectionName" with the actual source code collection name which is typically "DefaultCollection".
Note that this was written in VB, and requires the following references.
Default references of System, System.Core, XML, and XML.Linq are included.
From "C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\ReferenceAssemblies\v2.0"
Microsoft.TeamFoundation.Client
Microsoft.TeamFoundation.Common
Microsoft.TeamFoundation.VersionControl.Client
Option Explicit On
Option Strict On
Option Infer Off
Imports System
Imports System.Collections.Generic
Imports System.Linq
Imports System.Text
Imports Microsoft.TeamFoundation.Client
Imports Microsoft.TeamFoundation.VersionControl.Client
Imports Microsoft.TeamFoundation.Framework.Client
Imports System.IO
Namespace EnumerateTFSSecurity
Friend Class Program
Private Shared UpdateConsoleIndex As Integer
Shared Sub Main()
Try
Dim tfs As TfsTeamProjectCollection = TfsTeamProjectCollectionFactory.GetTeamProjectCollection(New Uri("http://TFSServer:8080/tfs/CollectionName"))
Dim OutputFileName As String = ".\EnumTFSSec.txt"
If Command().Length <> 0 Then
OutputFileName = Command()
End If
tfs.EnsureAuthenticated()
Dim VersionControl As VersionControlServer = tfs.GetService(Of VersionControlServer)()
Dim OutputFile As StreamWriter = New StreamWriter(OutputFileName)
Dim AllProjs() As TeamProject = VersionControl.GetAllTeamProjects(True)
For Each TeamProj As TeamProject In AllProjs
GetChildItems(VersionControl, TeamProj.ServerItem, OutputFile)
OutputFile.Flush()
Next
Catch e As Exception
Dim ex As String = e.Message
Console.WriteLine("!!EXCEPTION: " & e.Message)
Console.WriteLine("Continuing... ")
End Try
Console.WriteLine("========")
Console.Read()
End Sub
Private Shared Sub GetChildItems(VersionControl As VersionControlServer, ItemPath As String, OutputFile As StreamWriter)
Dim Items() As Item = VersionControl.GetItems(ItemPath & "/*").Items
Dim FolderPaths As Specialized.StringCollection
Dim FilePaths As List(Of String)
FolderPaths = New Specialized.StringCollection
FilePaths = New List(Of String)
GetSecurityInfo(VersionControl, {ItemPath}, OutputFile)
For Each Item As Item In Items
If Item.ItemType = ItemType.Folder Then
FolderPaths.Add(Item.ServerItem)
Else
FilePaths.Add(Item.ServerItem)
End If
Next
For Each Folder As String In FolderPaths
GetChildItems(VersionControl, Folder, OutputFile)
Next
If FilePaths.Count <> 0 Then
GetSecurityInfo(VersionControl, FilePaths.ToArray, OutputFile)
End If
End Sub
' Define other methods and classes here
Private Shared Sub GetSecurityInfo(VersionControl As VersionControlServer, ByVal ItemPaths() As String, OutputFile As StreamWriter)
Dim result As List(Of String) = New List(Of String)
Dim SecurityList() As ItemSecurity
Dim SecurityInfo As StringBuilder = Nothing
Dim Clearstringlength As Integer
Dim ConsoleText As String
Try
SecurityList = VersionControl.GetPermissions(ItemPaths, RecursionType.None)
SecurityInfo = New StringBuilder
If SecurityList IsNot Nothing AndAlso SecurityList.Length <> 0 Then
For Each ItemSecurity As ItemSecurity In SecurityList
With ItemSecurity
If .Inherit = False Then
SecurityInfo.Append(" - Inherit: False")
End If
For Each Entry As AccessEntry In .Entries
If (Entry.Allow.Length <> 0 OrElse Entry.Deny.Length <> 0) Then
SecurityInfo.AppendLine()
SecurityInfo.AppendLine(" Identity: " & Entry.IdentityName)
If Entry.Allow.Length <> 0 Then
SecurityInfo.Append(" Allow: ")
For Each Value As String In Entry.Allow
SecurityInfo.Append(Value & "; ")
Next
SecurityInfo.Remove(SecurityInfo.Length - 2, 2)
If Entry.Deny.Length <> 0 Then
SecurityInfo.AppendLine()
End If
End If
If Entry.Deny.Length <> 0 Then
SecurityInfo.Append(" Deny: ")
For Each Value As String In Entry.Deny
SecurityInfo.Append(Value & "; ")
Next
SecurityInfo.Remove(SecurityInfo.Length - 2, 2)
End If
End If
Next
If SecurityInfo.Length <> 0 Then
SecurityInfo.AppendLine()
End If
End With
If UpdateConsoleIndex Mod 25 = 0 Then
ConsoleText = "Item:" & ItemSecurity.ServerItem
Clearstringlength = If(Console.CursorTop = 0, 0, Console.CursorTop * Console.BufferWidth - 1) - ConsoleText.Length
Console.CursorTop = 0
Console.CursorLeft = 0
If Clearstringlength > 0 Then
ConsoleText &= New String(" "c, Clearstringlength)
End If
Console.WriteLine(ConsoleText)
End If
If SecurityInfo IsNot Nothing AndAlso SecurityInfo.Length > 0 Then
If UpdateConsoleIndex <> 0 Then
OutputFile.WriteLine()
End If
OutputFile.Write("Item:" & ItemSecurity.ServerItem)
OutputFile.Write(SecurityInfo.ToString())
SecurityInfo.Clear()
End If
UpdateConsoleIndex += 1
Next
End If
Catch e As Exception
Dim ex As String = e.Message
Console.WriteLine("!!EXCEPTION: " & e.Message)
Console.WriteLine("Continuing... ")
End Try
End Sub
End Class
End Namespace