TFS Azure Devops - This access control list is not in canonical form and therefore cannot be modified

Question

I am not able to check the code into Team Foundation Server source control. Visual Studio is showing an error "This access control list is not in canonical form and therefore cannot be modified." like this. It does not specify the path with the problematic ACL. Is there any solution to this?

Answer 1

The access control list for a file or folder needs to be rewritten in canonical form. Open an administrator PowerShell prompt. I found that this does not necessarily work unless running as an administrator, although no errors indicate that it fails.

First try the directory where TFS stores the workspace files:
cd $env:localappdata
cd '.\Microsoft\Team Foundation\'
gci -Recurse | % { Get-Acl $_ | Set-Acl $_ } # rewrite ACLs for all child folders and files.
$x = gi . # get current folder
Get-Acl $x | Set-Acl -Path $x # rewrite its ACL.

Now try parent directories (repeat this procedure to recurse up - for me the problem was fixed once I rewrote the ACL for the AppData folder).

$x = $x.Parent # get the parent directory
$x # display the folder to the console so you know what path you are working on.
Get-Acl $x | Set-Acl -Path $x # rewrite its ACL.

If this does not work, try repeating these steps for your source control path and its parent directories.