How can I always block checkin of a specific file in TFS

One of TFS undervalued features is cloaking. Like SVN’s ignore, cloaking will let you ignore a certain folder or files.

Cloaking a Folder

Cloaking a folder is easy: just right click a folder on the source control explorer and select Cloak

Cloaking a File

The UI doesn’t expose cloaking on a single file, but sometimes you may want to cloak a certain file like app.config.

1. Go to File > Source Control > Workspaces

2. Select your workspace and click Edit.

3. Under the working folders, and a new entry with status Cloaked and enter the full server path of the file you want to cloak. (E.g.: $/MyTeamProject/Dev/Src/SomeProject/app.config)

Using Local Workspace .tfignore file (In TFS 2012, 2013, 2015 and up)

In Local Workspace, use you can use .tfignore file (the equivalent of .gitignore for Git)

.tfignore file example
 ######################################
# Ignore .cpp files in the ProjA sub-folder and all its subfolders
ProjA\*.cpp
# 
# Ignore .txt files in this folder 
\*.txt
#
# Ignore .xml files in this folder and all its sub-folders
*.xml
#
# Ignore all files in the Temp sub-folder
\Temp
#
# Do not ignore .dll files in this folder nor in any of its sub-folders
!*.dll

Blocking by Permissions

Another approach is deny check-in on the file
(requires administrative privileges):

1. Right click the file > click Properties > Security

2. Add your user and mark Deny on the Check In permission.