IIS Express vs IIS Site and Access Denied Error

Question

Trying to migrate a legacy .net site from a SharePoint 2010 farm to SharePoint 2016. Simple IIS site that has one page for testing.

Run the site in IIS Express and everything works. Run the same site in IIS and I receive an Access Denied error.

  SPSecurity.RunWithElevatedPrivileges(Function() doSP(hURL))

  Function doSP(hURL As String)
                    Using hSite As New SPSite(hURL)
                        Using hWeb As SPWeb = hSite.OpenWeb()
                            Dim listItems As SPListItemCollection = hWeb.Lists("testx").Items
                            Dim item As SPListItem = listItems.Add()
                            item("Title") = "test1"
                            item.Update()
                        End Using
                    End Using
  End Function

App pool is running as my account and I also tried using the farm account. My account is granted Full Control to the SharePoint web app via User Policy. Also granted my account Site Collection Admin permissions.

Full error:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Answer 1

try using AllowUnsafeUpdates = true; before the update and AllowUnsafeUpdates = false; after the update.

also like to note its very clear on IIS 8 the pitfalls of running code express (admin level) vs IIS (restricted permission)

Security Context for IIS Express

---

An important difference between the development servers in Visual Studio and IIS is the security context in which the servers run your ASP.NET pages. This difference can be a source of problems when you deploy a web site or web application to run on IIS.

When you run a page using IIS Express, the page runs in the context of your current user account. For example, if you are running as an administrator-level user, a page running in IIS Express will have administrator-level privileges. In contrast, in IIS 7 and IIS 8, ASP.NET runs as an account that has limited privileges by default. For more information, see Application Pool Identities on the IIS.net web site.

If you are simply reading and running the code in ASP.NET pages, this difference is not very important. However, the different security contexts for the two web servers can affect your testing in several ways:

https://msdn.microsoft.com/en-us/library/58wxa9w5(v=vs.120).aspx

if the above code doesn't work then look at impersonation rather than elevation.