SharePoint 2010 - Access denied during ApplyWebConfigModifications()

Question

I have SharePoint 2010 installed on a Windows Server 2008 R2 machine which is also hosting SQL Sever 2008 R2. I am attempting to deploy a solution that includes web parts in the 2010 environment that is working fine in MOSS 2007.

The Web Part feature has a feature receiver that updates the web.config. When I try to activate the feature through the Site Collection Feature GUI, I receive an access denied message. I am logged on to the server and in SharePoint with the APP Pool account which is also a member of the domain administrator group, local administrator group and SharePoint Farm Admin group. This account is also dbo on SQL Server.

This same feature activates fine using the stsadm command.

I have dug into this issue at length and here is what I have found:

Looking at the Microsoft assemblies in reflector, my error is coming from the SPWebApplication.ApplyWebConfigModifications() method. I can see the trace statements from SPWebConfigFileChanges.RemoveModificationsWebConfigXMLDocument and SPWebConfigFileChanges.ApplyModificationsWebConfigXMLDocument. The next line is a Save(str).

Below is the output from the SharePoint logs that pertain to this error:

Apply web config modifications to web app
5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
General 8grn Medium WebConfigModification: Applying web config modifications to web app in server tw-s1-m4400-007
5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 88gw Medium WebConfigModification: Applying web config modifications to file C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config 5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 887b Medium Removing web config node - Path configuration/system.web/httpModules Node name add[@name='JivePageController']
5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 887b Medium Removing web config node - Path configuration/system.web/httpHandlers Node name add[@path='ScriptResource.axd']
5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 887b Medium Removing web config node - Path configuration/runtime/*[local-name()="assemblyBinding" and namespace-uri()="urn:schemas-microsoft-com:asm.v1"] Node name [local-name()="dependentAssembly"][/@name="System.Web.Extensions.Design"] 5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 887b Medium Removing web config node - Path configuration/runtime/*[local-name()="assemblyBinding" and namespace-uri()="urn:schemas-microsoft-com:asm.v1"] Node name [local-name()="dependentAssembly"][/@name="System.Web.Extensions"] 5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 8gp8 Medium WebConfigModification: Adding web config node - Path - configuration/runtime/*[local-name()="assemblyBinding" and namespace-uri()="urn:schemas-microsoft-com:asm.v1"] Node name - [local-name()="dependentAssembly"][/@name="System.Web.Extensions"] Node value - in web.config file C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config 5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 8gp8 Medium WebConfigModification: Adding web config node - Path - configuration/runtime/*[local-name()="assemblyBinding" and namespace-uri()="urn:schemas-microsoft-com:asm.v1"] Node name - [local-name()="dependentAssembly"][/@name="System.Web.Extensions.Design"] Node value - in web.config file C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config 5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 8gp8 Medium WebConfigModification: Adding web config node - Path - configuration/system.web/httpHandlers Node name - add[@path='ScriptResource.axd'] Node value - in web.config file C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config 5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 8gp8 Medium WebConfigModification: Adding web config node - Path - configuration/system.web/httpModules Node name - add[@name='JivePageController'] Node value - in web.config file C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config 5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.09 w3wp.exe (0x15C4)
0x1444 SharePoint Foundation
Topology e5mb Medium WcfReceiveRequest: LocalAddress: 'http://tw-s1-m4400-007.jivedemo.local:32843/15702467ece1408f881abeabac3b5077/MetadataWebService.svc' Channel: 'System.ServiceModel.Channels.ServiceChannel' Action: xxx MessageId: 'urn:uuid:4e859532-ed7f-4937-8b88-68d3af43d589' 9f403ede-2c94-490b-a05c-e169cc5fe58d

02/24/2010 16:05:41.10 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology f6kh High WebConfigModification: Save of web.config file C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config for applying modifications to web app SharePoint - 2008 failed. Error message - Access to the path 'C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config' is denied.
5a817a37-7bf6-4d26-be51-207369e38f5b

02/24/2010 16:05:41.10 w3wp.exe (0x0F64)
0x1034 SharePoint Foundation
Topology 8j2o High WebConfigModification: Changes not applied to web application SharePoint - 2008 with Url xxx
5a817a37-7bf6-4d26-be51-207369e38f5b

Any help would be appreciated!

Answer 1

Try changing the feature's scope to WebApplication and activating it from within Central Admin

Answer 2

Make sure the identity of your application pool has read/write access to directory that contains the web.config.

Also make sure the identity of your SharePoint Timer Job has read/write access to the directory that contains the web.config file.

Answer 3

C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config for applying modifications to web app SharePoint - 2008 failed. Error message - Access to the path 'C:\inetpub\wwwroot\wss\VirtualDirectories\2008\web.config' is denied.

Check this file permissions and adjust them appropriately.

Answer 4

I have the same issue. Did you find a solution?

Answer 5

Check whether UAC (User Account Control) is on and turn it off if this is a test/demo environment. The other option (and the best option for Production environments) is to right click the central admin link and choose the option to 'Run as Administrator'.

I got burnt by this for a little while and the reason is because of the way the security check is performed before the solution deployment job runs. If you are running with UAC enabled then this check will always fail (see the Remarks section on MSDN for system.security.principal.windowsprincipal).

Answer 6

Our solution was to reorganize our feature architecture such that we now have a Web Application scoped feature in addition to 2 Farm scoped features and 2 Site Collection scoped features. We moved our code that dealt with WebConfigModifications from our site collection scoped features to our new web application scoped feature.

This was the way it should have been done all along (and how we tried to do it initially a while back), but the SharePoint Solution Installer did not support our feature architecture so we worked around it by having a bit of code trying to deal with WebConfigModifications at the site collection level. This had some rough side-effects like requiring the account that activated the site collection feature to also be a farm administrator - and we had to have some smart code to not apply or remove our settings multiple times.

So, we had to update the SharePoint Solution Installer for this - and also get it to work in SharePoint 2010. It is not released yet, but watch http://sharepointinstaller.codeplex.com/ for releases that support this scenario for both SharePoint 2007 and SharePoint 2010.