Re: xp_cmdshell right for non sysadmin

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Sue Hoegemeier (Sue_H_at_nomail.please)
Date: 04/06/04 

Date: Tue, 06 Apr 2004 13:55:05 -0600

Hi Mike,
In regards to the account privileges, I'm referring to the
service account not the proxy account - the account that SQL
Server runs under. That's most likely where the issues are.
Not the proxy account but the account that the SQL services
are running under. It looks like there are missing
permissions for the SQL Server service account.
When a non-sa is executing xp_cmdshell and you have the
proxy account set up, SQL Server will change it's security
context to the proxy account. That's the area of permissions
that appear to be missing.

-Sue

On Tue, 6 Apr 2004 12:46:03 -0700, "mikew"
<anonymous@discussions.microsoft.com> wrote:

>Hi, Sue. Thank you.
>I did change the SQL agent proxy account info via Enterprise manger.
>Why it is still not correct?
>For testing purpose, I login using this NT proxy account and try to execute xp_cmdshell, it works.
>But when I login in as a no-sa SQL user, it give me that error.
>Thanks again. mike

Relevant Pages

  • Re: xp_cmdshell default path (system32) problem
    ... I've used the proxy account several times before. ... SQL script that contains the xp_cmdShell is executed while logged in as 'sa' ... - specify the full path in the del command ... I'm use xp_cmdShell to execute "erase" command like ...
    (microsoft.public.sqlserver.programming)
  • Setting the SQL Agent proxy account
    ... When trying to reset the proxy account for the SQL Server Agent we get ... All actions are performed with a sysadmin user (on server & sql level). ...
    (microsoft.public.sqlserver.security)
  • RE: xp_cmdshell, Access Denied, Further Investigation Reveals
    ... As i tried to explain the Agent proxy account has Admin rights, ... this share and security tab show the admin group in with this user ... This is not just a problem with SQL if you read below i used ... > member of the sysadmin group, xp_cmdshell will impersonate the SQL Server ...
    (microsoft.public.sqlserver.security)
  • CmdExec and Environment
    ... Unfortunately several of my sql users need tot run cmdexe jobs ... configured a proxy account with not to much rights on the files system. ... For each virtual server I created a separate temp dir for the proxy user. ...
    (microsoft.public.sqlserver.clustering)
  • Re: SQL 7 Server does not seam to respect NTFS permissions.....
    ... There is also an account that the SQL ... Server Agent runs under and a proxy account as well. ... > Thank you Andrew, that clears that up. ...
    (microsoft.public.sqlserver.security)