Using the Team Foundation Power Tools (TFPT) you can…
1. Query work items using the command line:
tfpt query /format:id /wiql:"SELECT [System.Id] FROM WorkItems WHERE [System.TeamProject] = 'MyProject' AND [System.WorkItemType] = 'Bug' AND [System.State] = 'Active' AND [System.Reason] = 'New'" /collection:http://servername:8080/tfs
2. And by adding the pipe command you can change the work items returned by the query:
(… command from above …) | tfpt workitem /update @ /fields:"State=Resolved;Reason=Fixed"
Changes you make to local or Active Directory groups do not get reflected in TFS immediately. Instead, TFS will synchronize those groups regularly (by default every hour).

Known workarounds:
- You can re-add the security group in TFS, this will trigger a identity synchronization.
- In TFS 2005/2008: you could restart IIS or the TFS App Pool to force an identity synchronization (does not work for TFS 2010).
- Using the JobService webservice, you can queue the identity synchronization job.
- Or use this tool to trigger the web service:

(Note: The user needs to have the 'Queue background jobs' permission on TFS)
Download the tool from here:
Update:
- You can specify "/status" to only query the time of the last identity synchronization.
(only requires 'View background job information' permission on TFS)
If you configured a public FQDN for your TFS and the "Team Web Access" link on the project portal still points to the non-FQDN URL…

… all you need to do is: using the Team Foundation Admin Console, in the "Extensions for SharePoint Products" node, change the TFS URL (= Integration Target) to use your public name (with FQDN):

Customizing Work Item Types
Work Item Type Schema Reference
(Thanks to KathrynE)
Update (Aug 8th, 2011): How to get in IntelliSense when editing WITDs and where to download the XML schema is explained in this blog post by Allen Clark from Microsoft.
As you probably noticed or know already, TFS 2010 by default delays all notifications (aka project alerts) by 2 minutes (as explained here).
You can change the default by setting the following key in the TFS registry (not the Windows Registry on the TFS server) to the desired number of seconds (0 = no delay, 120 = the default of 120 seconds):
/Service/Integration/Settings/NotificationJobDelay = #seconds
To change the value (in this example to 30) in the TFS registry you can use this PowerShell script or the following command line:
tfsreg.exe /server:https://yourtfs:8080/tfs /path:/Service/Integration/Settings/NotificationJobDelay /value:30

If you don't specify the value parameter, it will print out the current value.
Download the tool from here:
- For Team Explorer 2010: TfsReg.exe (.ZIP, 3,53 KB)
- For Team Explorer 2012: TfsReg.exe (.ZIP, 3,56 KB)
Note: You need to restart the IIS app pool that TFS uses, for this change to take effect.
Prerequisite: This tool requires Team Explorer 2010/2012 to be installed.
(Thanks to Chris Sidi for his excellent blog post on this.)