Project Server 2010: Removed the manage site services permission and can’t get it back?

There is a new permission in Project Server 2010 called Manage Site Services which controls access to those services which operate at the farm level – such as OLAP services etc.  We have discovered a scenario where you cannot re-enable the Server Level permission “Manage Site Services” once you have cleared the permission.  Removing this permission prevents the ability to change the Administrators Group, manage Queue Settings, perform Active Directory Synchronization, manage Event Handlers and Build OLAP Cubes.

In order to work around the problem, you will need to run the following SQL command against the Published Database :

UPDATE dbo.MSP_WEB_SECURITY_ORG_PERMISSIONS

SET WSEC_ALLOW = 1, WSEC_DENY = 0

where WSEC_FEA_ACT_UID = '55FE20B7-73D6-421A-A0A8-41B8A482AE8B'

This script will re-enable the Manage Site Services permission for PWA so that you will be able to perform the blocked tasks. 

So if you have managed to lock yourself out of these permissions this is the answer.  We don’t normally suggest direct database access – but this is one of those times when it is the only way.