Populating <validuser/> field in WorkItem

Question

I've created a new WorkItem named Project that contains a field named business owner which can be any domain user.

The field was created using the WorkItem XML syntax using the tag. I have a problem that only TFS valid users (as the name suggests :)) show up the the combobox in the Visual Studio form.

Is there any way for me to let that box contain all domain users without having to give all users some tfs read access ? If not then what is the minimum access that I can apply in TFS that I can give to all domain users ? Or is there some other way that I can't notice ?

Answer 1

Alright, I'll answer my own question here :)

In order to populating the validusers combobox we decided on giving the domain users group access to the Valid Users TFS group. There are some security risks involved, e.g.

1. Users are able to see Work Item queries but searching will not return any results
2. Users will be able to see build results and links to build logs, you can however apply windows level security on build drop locations
3. Users will not have access to WSS or Report sites

So anyone going down this route should check if these security issues are acceptable