Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase

XP_Cmdshell 'Access is denied' Expand / Collapse
Author
Message
Posted Tuesday, May 8, 2012 11:19 PM
SSC Veteran

SSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC Veteran

Group: General Forum Members
Last Login: Wednesday, March 19, 2014 6:30 AM
Points: 250, Visits: 743
Hi All,

xp_cmdshell 'dir \\Server001\e$' - running in Server2
xp_cmdshell 'dir \\Server002\e$' - running in server1

OUTPUT : 'Access is denied.'

But I'm able to access through RUN(WIN+R) command from server1 to server2 and vice versa.

NOTE: I've given 'full control' permission on both folders in E\ drive in both servers.

Please advice.

Thanks and Regards,
Ravi
Post #1296885
Posted Wednesday, May 9, 2012 10:10 AM


SSCertifiable

SSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiable

Group: General Forum Members
Last Login: Today @ 1:41 PM
Points: 6,318, Visits: 13,623
ravisamigo (5/8/2012)
Hi All,

xp_cmdshell 'dir \\Server001\e$' - running in Server2
xp_cmdshell 'dir \\Server002\e$' - running in server1

OUTPUT : 'Access is denied.'

But I'm able to access through RUN(WIN+R) command from server1 to server2 and vice versa.

NOTE: I've given 'full control' permission on both folders in E\ drive in both servers.

Please advice.

Thanks and Regards,
Ravi

Please post the result of the foloowing query when executed against the sql server instance

select value_in_use from sys.configurations 
where name = 'xp_cmdshell'



-----------------------------------------------------------------------------------------------------------

"Ya can't make an omelette without breaking just a few eggs"
Post #1297244
Posted Wednesday, May 9, 2012 10:35 AM


SSChampion

SSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampion

Group: General Forum Members
Last Login: Today @ 8:07 PM
Points: 12,910, Visits: 32,028
ravisamigo (5/8/2012)
Hi All,

xp_cmdshell 'dir \\Server001\e$' - running in Server2
xp_cmdshell 'dir \\Server002\e$' - running in server1

OUTPUT : 'Access is denied.'

But I'm able to access through RUN(WIN+R) command from server1 to server2 and vice versa.

NOTE: I've given 'full control' permission on both folders in E\ drive in both servers.

Please advice.

Thanks and Regards,
Ravi


if you touch anything outside of SQL server (local directories, UNC shares, mapped drives, your own credentials don't count and are not used.
SQL WILL pass your credentials to a linked server, but anything else is using an account you did not intuitively expect it to use.

SQL Server uses either the account set up as the proxy account, or if that is left blank(the default) it uses account it starts with to try and access the resource:

or if the above was blank, the account in services:


That account is often an account which has never logged into the domain, and was never assigned permissions to get to the local disk or network share.
As a result, you usually need to create a domain account in Active Directory, specifically grant it share access if it doesn't inherit it from Domain\Users or Domain\AuthenticatedUsers and change the account SQL Server starts with to that account.


Lowell

--There is no spoon, and there's no default ORDER BY in sql server either.
Actually, Common Sense is so rare, it should be considered a Superpower. --my son
Post #1297271
Posted Thursday, May 8, 2014 4:06 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Thursday, May 8, 2014 4:02 PM
Points: 5, Visits: 34
I know this is an old post, my apologies. I had this same issue... so I did the above suggestion and set the Logon account for the SQL Server Service in my config manager to use a domain account instead, so my sysadmin users on the sql server could use xp_cmdshell. This worked and fixed the problem, HOWEVER, in doing so it made the SQL Server instance only accessible to the local box. When trying to access through SSMS from a different box I would get a "Cant generate SSPI Context error".

Any Suggestions?

Thank you in advance
Post #1569104
« Prev Topic | Next Topic »

Add to briefcase

Permissions Expand / Collapse