How can I always block checkin of a specific file in TFS

Solution 1:

One of TFS undervalued features is cloaking. Like SVN's ignore, cloaking will let you ignore a certain folder or files.

Cloaking a Folder

Cloaking a folder is easy: just right click a folder on the source control explorer and select Cloak

Cloaking a File

The UI doesn't expose cloaking on a single file, but sometimes you may want to cloak a certain file like app.config.

Go to File > Source Control > Workspaces
Select your workspace and click Edit.
Under the working folders, and a new entry with status Cloaked and enter the full server path of the file you want to cloak. (E.g.: $/MyTeamProject/Dev/Src/SomeProject/app.config)

Cloaking a file

Using Local Workspace .tfignore file (In TFS 2012, 2013, 2015 and up)

In Local Workspace, use you can use .tfignore file (the equivalent of .gitignore for Git)

.tfignore file example
 ######################################
# Ignore .cpp files in the ProjA sub-folder and all its subfolders
ProjA\*.cpp
# 
# Ignore .txt files in this folder 
\*.txt
#
# Ignore .xml files in this folder and all its sub-folders
*.xml
#
# Ignore all files in the Temp sub-folder
\Temp
#
# Do not ignore .dll files in this folder nor in any of its sub-folders
!*.dll

Blocking by Permissions

Another approach is deny check-in on the file (requires administrative privileges):

Right click the file > click Properties > Security
Add your user and mark Deny on the Check In permission.

Deny Check In

Solution 2:

For TFS 2012, just use the .tfignore file.

When you add ignored files to folders that are mapped in a local workspace, they do not appear in the Pending Changes page in Team Explorer.

http://msdn.microsoft.com/en-us/library/ms245454.aspx