Project Active Directory PWA group could not be resolved

Summary:   During Microsoft Project Web App security group synchronization, Microsoft Project Server could not resolve the top-level Active Directory object for the Project Web App security group. Active Directory synchronization has been tagged for failure for this UNRESOLVED_TOKEN_VAL(PWA_2nd_NoVer) group.

Cause:   The Project Server application server cannot access Active Directory for any of the following reasons:

• The Project Server application server is using a SharePoint Service Account (SA) account that does not have read access to the Active Directory directory service. This can occur if the SSP is configured to use a local computer account.

• The Project Server application server does not currently have network access to the domain.

• TCP or UDP ports that are required for Project Server and Active Directory to communicate are not open between the Project Server application server and the Active Directory store. This can occur if a firewall is configured to block the ports described in the following list:

  • 389/UDP – LDAP: LDAP is the Lightweight Directory Access Protocol that provides a standard way to access directory services. LDAP is the primary protocol that is used to access an Active Directory store.

  • 636/TCP – LDAP over SSL: When Secure Sockets Layer (SSL) is enabled, the LDAP data that is transmitted and received is encrypted.

  • 3268/TCP – Microsoft global catalog: Active Directory global catalogs listen on this port.

  • 3269/TCP – Microsoft global catalog with LDAP/SSL: Microsoft global catalog SSL connections listen on this port.

• The Active Directory group no longer exists in the Active Directory store. For example, the group may have been deleted by an administrator.

• The Project Server application server's SA account does not have read access to an Active Directory group or user object.

Possible resolutions include the following:

• Verify that the service account that is used by the SA that is used by the Project Server application server is a domain account that has read access to Active Directory.

• Verify that the Project Server application server is joined to an Active Directory domain.

• Verify that the Project Server application server has network access.

• Verify that the TCP and UDP ports listed in the previous section are open between the Active Directory store and the Project Server application server.

• Verify that at least one Active Directory group exists in the Active Directory store with the same Active Directory GUID that is stored in the Office Project Server application server.

• Use the Active Directory Service Interfaces (ADSI) Edit tool to check security permissions on individual Active Directory group and user objects. The SA account must be able to read all Active Directory group and user objects that are involved in the synchronization process.

  Note

  The ADSI Edit tool is available for Windows Server 2008 when you install the Active Directory Domain Services (AD DS) role to make a server a domain controller. It is also available as a part of the Remote Server Administration Tools (RSAT) kit available. See Installing or Removing the Remote Server Administration Tools Pack (https://go.microsoft.com/fwlink/p/?LinkId=143345) in the TechNet Library.