TFS 2013 manage branch denied but folders still created

Hi,

We're using TFS 2013 and I have set up TFS VC permissions so that by default the development group don't have Manage Branch permission (NOT SET) but can check in and merge. Lead Developers will have the ability to manage branches and managed as a separate group.

However it seems that if a developer attempts to take a branch it basically copies the structure and checks it in but doesn't make it a branch and does display a message:

TF14098: Access Denied: User <> needs ManageBranch permission(s) for <>

So clearly TFS is blocking a branch being made but why is it allowing the folder to be created - I'd have expected this to be a single transaction that gets rolled back when it determines that the user doesn't have permission. Unless I'm missing something in my permission set up?

I really don't want a load of headless copies of code checked in so is there anything I can to prevent this?

Thanks

Leyton