How do I bind a field definition rule to an AD Group for a custom TFS 2010 Work Item Template?

Question

I am attempting to add a "Requested By" field to a custom Work Item Template in TFS 2010. When I create the field in the work item, I wish to have the values restricted to a particular AD group. I'm looking for functionality similar to the "Assigned To" field in the standard templates. However, if I add this AD group to one of the TFS groups, they all get added as valid users in TFS and that is not the behavior I'm looking for. I simply wish to restrict the values for a field to an specific AD group. I've tried adding the AD group to the "Group" property of the VALIDUSER field definition rule, but I get the following error:

---------------------------
Error
---------------------------
Error importing work item type definition:

TF26204: The account you entered is not recognized. Contact your Team Foundation Server administrator to add your account.
---------------------------
OK   
---------------------------

Thanks in advance!

[Update] On further investigation, I have found that it works with certain AD groups, but not with others. For instance, it works with our "Developers Group" but not with "Domain Users". It's actually a fairly small subset of groups that I've tested that work. Again, Any help would be appreciated!

Answer 1

The simplest way I've found is to use the ALLOWEDVALUES field definition rule. Add to the list of allowed values the name of a TFS Group. I have still not been able to get the AD group to work directly. But my big problem was that when I was trying to use a project group, I was putting the project name in the "[Project]\Group Name".

As stated here

some people may think that “[project]” is a place holder for the project's name, but it is meant as a literal.

Answer 2

Have you tried to create a TFS Group, add the AD group in the TFS Group, then add the TFS Group in the "Group" property of the VALIDUSER field definition ?

If I remember correctly you can't put AD group in the "Group" property of a TFS Field, but only TFS Groups...

Answer 3

You should be able to add an AD group, by simply writing it as domain\group.

Note, however, that the group needs to have some access privileges to the team project (e.g. A member of Contributers).