Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are currently working on a project that involves sharepoint. We have created a template web and that contains specific content that we would like to have duplicated each time we create a new web. We have setup a create web user control running in a webpart. This creates the web from the template, sets up the necessary permissions and adds some features.

The problem:

We would like to have an alert setup for an email-enabled security group DOMAIN\sharepoint. We are using this VB.Net code:

Dim user As SPUser = w.EnsureUser("DOMAIN\sharepoint")
Dim alert As SPAlert = w.Alerts.Add()
alert.User = user
alert.AlertType = SPAlertType.List
alert.List = w.Lists("Information")
alert.Title = w.Title & " - " & alert.Title
alert.Properties("eventtypeindex") = "2"
alert.AlertFrequency = SPAlertFrequency.Daily

This works for users who are domain administrators but does not work for people who only have full control at this site's level. They can however go in and manually add the alert once the site is created. I do not have any problems when creating this with my own login but I am a member of domain admins and thus an administrator of all sharepoint sites. The error the users who have Full Control of this site only gets is an Access Denied error.

Edit: I never really stated what I wanted out of this. I would like to know if there is a way to circumvent this or if I can create an eventReceiver of some sort that for when the web itself is created to add the alert.


I have changed the code to the following and now I am getting an error

Dim authorizedCode As SPSecurity.CodeToRunElevated = New SPSecurity.CodeToRunElevated(AddressOf AddAlert)

Dim new_site As New SPSite(SPContext.Current.Site.ID, sysToken)
Dim web As SPWeb = new_site.AllWebs(w.ID)
Dim user As SPUser = web.EnsureUser("DOMAIN\sharepoint")
Dim alert As SPAlert = web.Alerts.Add()
alert.User = user
alert.AlertType = SPAlertType.List
alert.List = web.Lists("Information")
alert.Title = web.Title & " - " & alert.Title
alert.Properties("eventtypeindex") = "2"
alert.AlertFrequency = SPAlertFrequency.Daily

Where sysToken is obtained in

Public Sub AddAlert()
    Dim lolcatKiller As SPSite = New SPSite(SPContext.Current.Site.ID)
    sysToken = lolcatKiller.SystemAccount.UserToken
End Sub

But I am getting the exception

System.Runtime.InteropServices.COMException: The security validation for this page is invalid.

As far as I can tell I am still within the context of the systemuser

share|improve this question

There is a circumvention indeed. Wrap the code with RunWithElevatedPrivileges.

share|improve this answer
There's also Keith Dahlby's patterns for elevating privileges: – Alex Angas Oct 1 '09 at 9:59

for that exception use: web.AllowUnsafeUpdates = true;

share|improve this answer

For SP2010 I was able to fix it by making sure that the placeholder "PlaceholderFormDigest" wasn't inside the hidden placeholders section

These need to be in the page and working:

  <asp:ContentPlaceHolder id="PlaceHolderFormDigest" runat="server">    <SharePoint:FormDigest runat="server" />    </asp:ContentPlaceHolder>    <input type="text" name="__spText1" title="text" style="display:none;" />  <input type="text" name="__spText2" title="text" style="display:none;" />
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.