TFS 2015 machine groups cannot be selected in build/deployment definition (vnext) after creation

Question

We have a problem with a TFS 2015 installation, an upgrade from 2010. We ran into the following issue. This concerns a dry run, so we install everything on the same server, which is not a prefered method, we know.

• Installed new virtual server with Windows Server 2012 R2

• Added IIS feature

• Installed SQL server 2014

• Installed sharepoint foundation 2013 on the server

• Installed visual studio 2015 on the server

• Installed all the necessary .NET target frameworks

• Installed the prerequisites like MS Build tools 2015, Agents for Microsoft Visual Studio 2015

• Restored TFS2010 backups to new SQL server

• Installed tfs 2015 and ran the 'Upgrade' option in the setup

• Processed all the steps in configuration, like adding a build controller and build agent

• Dowloaded the Vso agent and ran the 'ConfigureAgent.cmd'

• Configured the agent pool and queue in TFS

• Added an extra collection of team projects. So we have a collection of legacy upgraded projects from 2010, plus a collection of new team projects

• Administered the team projects, team members, etc.

• Created a XAML build definition, builds are done correctly on the server, tests are performed

However,

If I try to create aa new (non XAML) build definition using the deployment template (see images). The problem occurs when we want to select a “Test Machine Group / Azure Resource Group”, for instance when selecting the location of testing. The select list is empty. So we added machine groups using the 'Manage' option, and the machine group is available. However the dropdown list with machine groups stays empty, even after refresh (see images).

Next we checked the event logs fort his issue. On a refresh of the dropdownlist the following entries are made in the event log :

First :

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Team Foundation Server" Guid="{80761876-6844-47D5-8106-F8ED2AA8687B}" /> 
  <EventID>0</EventID> 
  <Version>3</Version> 
  <Level>2</Level> 
  <Task>1</Task> 
  <Opcode>10</Opcode> 
  <Keywords>0x8000000000000001</Keywords> 
  <TimeCreated SystemTime="2016-04-12T09:09:21.717163200Z" /> 
  <EventRecordID>59666</EventRecordID> 
  <Correlation ActivityID="{6AD40FD3-10BA-4A7E-B6D9-F6926072DAB4}" /> 
  <Execution ProcessID="3376" ThreadID="6484" /> 
  <Channel>Microsoft-Team Foundation Server/Debug</Channel> 
  <Computer>KTBSV021.KTB.local</Computer> 
  <Security UserID="S-1-5-21-2105344776-4230907741-261866850-3716" /> 
  </System>
- <UserData>
- <Info TraceId="{00000001-0001-0001-0000-000000000000}" xmlns="http://schemas.microsoft.com/TeamFoundation/2010/Framework">
  <Tracepoint>0</Tracepoint> 
  <ServiceHost>{87670F79-6386-4363-9960-73B634419263}</ServiceHost> 
  <ContextId>10085</ContextId> 
  <ProcessName>w3wp</ProcessName> 
  <Username>KTB\tmpadmin</Username> 
  <VSID>{9E83242F-9944-4CBD-AF10-EF2D449A03B1}</VSID> 
  <Service>Web-Api</Service> 
  <Method>TaskDefinitionWebApiProxy.QueryEndpoint</Method> 
  <Area>DistributedTask</Area> 
  <Layer>WebApiProxy</Layer> 
  <UserAgent>Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko</UserAgent> 
  <Uri>/tfs/Default/_apis/distributedtask/endpoint</Uri> 
  <Path /> 
  <UniqueIdentifier>{A9646429-41CB-4137-A39A-D4E29EDDC389}</UniqueIdentifier> 
  <UserDefined /> 
  <ExceptionType>System.Net.WebException</ExceptionType> 
  <Message>System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at Microsoft.TeamFoundation.DistributedTask.Server.WebApiProxy.HttpRequestProxy.ExecuteRequest(HttpRequestMessage requestMessage, IList`1 sourceDefinitions, DataSource dataSource)</Message> 
  </Info>
  </UserData>
  </Event>

Second:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Team Foundation Server" Guid="{80761876-6844-47D5-8106-F8ED2AA8687B}" /> 
  <EventID>0</EventID> 
  <Version>3</Version> 
  <Level>2</Level> 
  <Task>1</Task> 
  <Opcode>10</Opcode> 
  <Keywords>0x8000000000000001</Keywords> 
  <TimeCreated SystemTime="2016-04-12T09:09:21.717163200Z" /> 
  <EventRecordID>59667</EventRecordID> 
  <Correlation ActivityID="{6AD40FD3-10BA-4A7E-B6D9-F6926072DAB4}" /> 
  <Execution ProcessID="3376" ThreadID="6484" /> 
  <Channel>Microsoft-Team Foundation Server/Debug</Channel> 
  <Computer>KTBSV021.KTB.local</Computer> 
  <Security UserID="S-1-5-21-2105344776-4230907741-261866850-3716" /> 
  </System>
- <UserData>
- <Info TraceId="{00000001-0001-0001-0000-000000000000}" xmlns="http://schemas.microsoft.com/TeamFoundation/2010/Framework">
  <Tracepoint>103200</Tracepoint> 
  <ServiceHost>{87670F79-6386-4363-9960-73B634419263}</ServiceHost> 
  <ContextId>10082</ContextId> 
  <ProcessName>w3wp</ProcessName> 
  <Username>KTB\tmpadmin</Username> 
  <VSID>{9E83242F-9944-4CBD-AF10-EF2D449A03B1}</VSID> 
  <Service>Web-Api</Service> 
  <Method>TaskDefinitionWebApiProxy.QueryEndpoint</Method> 
  <Area>DistributedTask</Area> 
  <Layer>TaskDefinitionWebApiProxy</Layer> 
  <UserAgent>Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko</UserAgent> 
  <Uri>/tfs/Default/_apis/distributedtask/endpoint</Uri> 
  <Path /> 
  <UniqueIdentifier>{A9646429-41CB-4137-A39A-D4E29EDDC389}</UniqueIdentifier> 
  <UserDefined /> 
  <ExceptionType>Microsoft.TeamFoundation.DistributedTask.WebApi.ServiceEndpointQueryFailedException</ExceptionType> 
  <Message>Microsoft.TeamFoundation.DistributedTask.WebApi.ServiceEndpointQueryFailedException: The remote server returned an error: (401) Unauthorized. at Microsoft.TeamFoundation.DistributedTask.Server.WebApiProxy.HttpRequestProxy.ExecuteRequest(HttpRequestMessage requestMessage, IList`1 sourceDefinitions, DataSource dataSource) at Microsoft.TeamFoundation.DistributedTask.Server.Controllers.TaskDefinitionWebApiProxyController.QueryEndpoint(TaskDefinitionEndpoint endpoint) at lambda_method(Closure , Object , Object[] ) at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ActionExecutor.<>c__DisplayClass10.<GetExecutor>b__9(Object instance, Object[] methodParameters) at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ExecuteAsync(HttpControllerContext controllerContext, IDictionary`2 arguments, CancellationToken cancellationToken) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Controllers.ApiControllerActionInvoker.<InvokeActionAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.ActionFilterAttribute.<ExecuteActionFilterAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.ActionFilterAttribute.<ExecuteActionFilterAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Web.Http.Filters.ActionFilterAttribute.<CallOnActionExecutedAsync>d__5.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.ActionFilterAttribute.<ExecuteActionFilterAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Controllers.ActionFilterResult.<ExecuteAsync>d__2.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.AuthorizationFilterAttribute.<ExecuteAuthorizationFilterAsyncCore>d__2.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Filters.AuthorizationFilterAttribute.<ExecuteAuthorizationFilterAsyncCore>d__2.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Web.Http.Controllers.ExceptionFilterResult.<ExecuteAsync>d__0.MoveNext()</Message> 
  </Info>
  </UserData>
  </Event>

Fiddler reports it is the following request is failing :

POST http://localhost:8080/tfs/Default/_apis/distributedtask/endpoint HTTP/1.1

• Powershell Remote has been enabled on the server.

• The service account has been added to the role in the agent pool.

It is obviously a security issue. What are we forgetting or doing wrong ?

Answer 1

Your issue is kinda like this post . You may try the solution in this case to add TFS service account to C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys with full access so that the service can access all the certificates.

But first of all, try to re-deploy the agent with your account that should have been added as a team project collection administrator or an agent pool administrator.