SPSecurity.RunWithElevatedPrivileges

Question

When a piece of code runs inside of SPSecurity.RunWithElevatedPrivileges basically it gets application pool identity. But which privilege it really gets? site-collection administrator or farm administrator?

Answer 1

David has pointed a good overview of elevating vs impersonation!

SharePoint site application pool account under which your web applications run, is usually (in the best practices) a domain account and can be seen in IIS settings (See below):

In the least privileges perspective, application pool account shouldn't be part of your farm administrators group because farm administrators normally have permission to modify the SharePoint configuration database.

Read more on Technet: http://technet.microsoft.com/en-us/library/hh344224.aspx

Answer 2

The code runs as SHAREPOINT/SYSTEM account for internal calls to SharePoint and since this is not a recognised Windows account it uses the Application Pool account to reach external resources. Moreover, when you write code using SPSecurity.RunWithElevatedPrivileges you need to create another context to an SPSite object. I think we could say it would be equivalent to a Site Collection Administrator.

Answer 3

Check out this article for a great overview of elevating vs impersonation. It goes into the details of what you get with both options in SharePoint. http://www.schaeflein.net/impersonation-and-elevation-of-privilege/