uac - ASP.NET Impersonation with Elevation -

i have asp.net application configured via web.config use impersonation this:

<system.web>     <identity impersonate="true" />     <authentication mode="windows" /> </system.web> 

the application needs perform administrative tasks. works fine if i'm logged on application user administrator, won't work (access administrative-only system resources fails) when logged in as, say, usera, does have administrative access on system.

i suspect what's happening here uac stepping in. although asp.net app impersonating usera, when comes performing requiring elevation, fails, whereas running administrator fine, since user starts out elevated (never gets uac prompt if performing actions interactively in windows).

incidentally, don't need network-level impersonation, don't believe should need delegation?

our company messed in house application , uac on 2 weeks. took 2 approaches issue.

first, created security group , security policies, created user , assigned web application pool run user. got around of our issues.

when didn't fix of our issues, , couldn't application fixed work permissions give it... turned off uac on server. far huge security risk, , places won't acceptable. but, administrator tokens needed of tasks needed completed.

i doubt it's possible have application pool present uac authentication box desktop user, because of sandbox services given. if applies, may want sysadmin/it department involved , talk risks, , benefits of different approaches.