It’s not often these days I come across what seems to be a new Project Server 2010 error! Having said that, I would expect the same error to occur on either 2007 or 2013 as it relates to AD sync.
Anyway while working with a customer recently I came across the following issue that had started occurring for all new projects being created as well as on any attempt to synchronize the site permissions from Server Settings – Project Sites.
The effect of the error was that users cannot access any of the affected sites.
Notably though the AD sync was not experiencing any errors.
Error Messages
GeneralQueueJobFailed (26000) – SynchronizeMembershipForWssSite.SynchronizeMembershipForWssSiteMessage. Details: id=’26000′ name=’GeneralQueueJobFailed’ uid=’677df8c5-7409-4e20-8a05-e98395aa2af3′ JobUID=’3ca3af00-2e08-49aa-b693-f1314fc09b96′ ComputerName=’…’ GroupType=’SynchronizeMembershipForWssSite’ MessageType=’SynchronizeMembershipForWssSiteMessage’ MessageId=’1′ Stage=”
And in the ULS log we see some more details:
01/14/2014 15:43:07.23 Microsoft.Office.Project.Server (0x1694) 0x1558 SharePoint Foundation General 8kh7 High Access denied. You do not have permission to perform this action or access this resource.<nativehr>0x810200ce</nativehr><nativestack></nativestack> 237e539d-3835-4ec0-84d3-383759fccdb6
01/14/2014 15:43:07.23 Microsoft.Office.Project.Server (0x1694) 0x1AAC Project Server Queu cf0l Critical Standard Information:PSI Entry Point: Project User: …. Correlation Id: 237e539d-3835-4ec0-84d3-383759fccdb6 PWA Site URL: http://server/PWA SSP Name: Project Server Service Application PSError: GeneralQueueJobFailed (26000) A queue job has failed …
Investigation and Resolution
I’ve highlighted the interesting bits of the logs above, and on searching for this specific issue the only references relate to Search Service indicating one of the following causes:
- The FarmAdmin account is not a local admin on the servers.
- One or more AD accounts has been deleted and recreated with the same name.
So after speaking with the AD team it turns out the customer was in the middle of an Active Directory restructure (alarm bells start ringing!) and specifically about the same time when this issue was first reported the AD team had moved a group of PWA users into a new sub-domain in the same AD forest.
Reverting that change immediately corrected the isssue! Phew.
Not completely done yet though, as that change will need to be re-done in the near future further investigation was required. It turns out that the migration of accounts was being done in a staged manner, and specifically service accounts and admin accounts (including our Farm Admin) were NOT moved with the users, which is what caused our issue here.
If anyone else comes across this issue in the future let me know, as I have a strange feeling that this might be the first and last time this particular issue breaks a Project Server. :)