2

I have created one timer job which will add SharePoint content database.

When I am running timer job manually from central admin, Content database is being created successfully.

Now I have one list and and i have added "Item Added" event receiver on that list and on that event receiver I am running the same code used by the above timer job programmatically and in this context the code is throwing an "Access Denied" exception while creating content data base.(I am running code with SPsecurity.RunwithElevatedPrivileges)

I have checked following in my environment

  1. Application Pool account of my web application is added on "Farm Administrators"
  2. Application Pool account has "db_owner" rights on SharePoint config database
  3. I have added "Application pool" account in "Local Administrators" group.

Any suggestion what configuration I am missing?

  • You said the you are running the timer job from an event receiver. What does this actually mean? You are actually running a schedule of the timer job or you are directly calling one of the codebehind methods your timer job uses to run? – SPArchaeologist Mar 16 '15 at 10:14
  • I know there is no meaning to run "Timer Job" in event receiver !!! But let me tell you behind story I have one requirement like when i add entry on one list, the content database should be created automatically. So I have first tried to create content database directly from event receiver. but it was always giving access denied error. So that's why I have created timer job to create content database and from timer job, database is created successfully. So not I am calling that timer job from event receiver. Now getting my point? I am running timer job forcefully (SPTimerJob.Execute) – Kalpesh Vaghela Mar 16 '15 at 10:19
  • so, basically you run the code of the timer job manually. Ok, this explain the change in the results (working VS access denied). I – SPArchaeologist Mar 16 '15 at 10:37
1

Based on the situation you describe, you seem to be yet another victim of the remote administration security block introduced by SP2010 and still active by default in the 2013 version.

Strictly speaking, the block was developed to force security when managing SPPersistedObject.

Taken from Ms knowledgbase: "This feature explicitly blocks any modifications to the objects inheriting from SPPersistedObject in the Microsoft.SharePoint.Administration namespace and does not allow the content web applications to update the configuration database"

This roughly translates to - if you try to make an update that touches an SPPersistedObject from a web-site collection scopes you will be blocked with a generic Access Denied error even if you should be able to perform the action because you are running under farm admin account.

To confirm this is actually your case, you can try to disable the RemoteAdministratorAccessDenied property and see if this change enables your code to run.

[System.Reflection.Assembly]::LoadWithPartialName(“Microsoft.SharePoint”) > $null
[System.Reflection.Assembly]::LoadWithPartialName(“Microsoft.SharePoint.Administration”) > $null
$contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$contentService.RemoteAdministratorAccessDenied = $false
$contentService.Update()

The above PowerShell script (taken from here for sake of simplicity) will turn of the aforementioned security setting and enable you to perform the test (remember to reset the property to the original value afterwards!).

There is a problem though: if you are indeed a victim of this security setting, then the only solution that comes to mind is disabling the security check altogether. As you may expect, this isn't exactly a desirable solution. For that reason, should the test I suggest above confirm that you are indeed seeing the result of what I describe, before considering disabling the setting I strongly suggest that you consider reworking your solution so that you won't need to perform the offending operation.

  • Thanks. and its working and you are right this is not desirable solution in case of security purpose. Now I am trying another way to achieve this. I am creating one exe file(console application) for adding content database and trying to run that exe from event receiver. Let you know result soon. – Kalpesh Vaghela Mar 16 '15 at 11:05
0

I got the same exception while accessing the content database in Time Job Class. then I added the below code in Time Job Class which resolved the issue.

protected override bool HasAdditionalUpdateAccess()
        {
            return true;
        }

Hope this helps...

  • I have already set this property to true but no luck – Kalpesh Vaghela Mar 16 '15 at 10:27
  • Whether dbcreator server role is checked for the account? – Sharanya Mar 16 '15 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.