How to control, in TFS, updates to work item definitions\project templates on users with admin rights?

Question

Can you prevent a user with project admin or project collection admin rights from updating a project's work item definition or its project template?

Basically we have a TFS instance with multiple projects and project collections. We want to ensure we have one template and work item definition across all of them so any updates should happen across all project\project collections.

thanks

p.s. we do this since we are interfacing with another system and if a new, required field is added it will cause issues.

Answer 1

Members of the "Project Collection Administrators" and "Project Administrators" group have hard-coded admin permissions. Even if you remove the "Edit Project-Level Information" permissions, they have the ability to give that permission to themselves again.

The only way to prevent members of these groups from modifying the work item definitions, is to remove them from the group. Some people create a new administrators group and give them the same permissions, except for the permission to modify work item types.