Access denied while creating content database from event receiver

Question

I have created one timer job which will add SharePoint content database.

When I am running timer job manually from central admin, Content database is being created successfully.

Now I have one list and and i have added "Item Added" event receiver on that list and on that event receiver I am running the same code used by the above timer job programmatically and in this context the code is throwing an "Access Denied" exception while creating content data base.(I am running code with SPsecurity.RunwithElevatedPrivileges)

I have checked following in my environment

1. Application Pool account of my web application is added on "Farm Administrators"
2. Application Pool account has "db_owner" rights on SharePoint config database
3. I have added "Application pool" account in "Local Administrators" group.

Any suggestion what configuration I am missing?

Answer 1

Based on the situation you describe, you seem to be yet another victim of the remote administration security block introduced by SP2010 and still active by default in the 2013 version.

Strictly speaking, the block was developed to force security when managing SPPersistedObject.

Taken from Ms knowledgbase: "This feature explicitly blocks any modifications to the objects inheriting from SPPersistedObject in the Microsoft.SharePoint.Administration namespace and does not allow the content web applications to update the configuration database"

This roughly translates to - if you try to make an update that touches an SPPersistedObject from a web-site collection scopes you will be blocked with a generic Access Denied error even if you should be able to perform the action because you are running under farm admin account.

To confirm this is actually your case, you can try to disable the RemoteAdministratorAccessDenied property and see if this change enables your code to run.

[System.Reflection.Assembly]::LoadWithPartialName(“Microsoft.SharePoint”) > $null
[System.Reflection.Assembly]::LoadWithPartialName(“Microsoft.SharePoint.Administration”) > $null
$contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$contentService.RemoteAdministratorAccessDenied = $false
$contentService.Update()

The above PowerShell script (taken from here for sake of simplicity) will turn of the aforementioned security setting and enable you to perform the test (remember to reset the property to the original value afterwards!).

There is a problem though: if you are indeed a victim of this security setting, then the only solution that comes to mind is disabling the security check altogether. As you may expect, this isn't exactly a desirable solution. For that reason, should the test I suggest above confirm that you are indeed seeing the result of what I describe, before considering disabling the setting I strongly suggest that you consider reworking your solution so that you won't need to perform the offending operation.

Answer 2

I got the same exception while accessing the content database in Time Job Class. then I added the below code in Time Job Class which resolved the issue.

protected override bool HasAdditionalUpdateAccess()
        {
            return true;
        }

Hope this helps...