opc.three (4/8/2013)
If nuclear blasts were the only reason to leave xp_cmdshell disabled then you would have a great point. Unfortunately, that is simply too narrow a view.
The circle continues so you've compelled me to say it again. If someone has SA privs, they can get to the command line whether xp_CmdShell is enabled or not. If someone doesn't have SA privs, they can't get to the command line whether xp_CmdShell is enabled or not. I believe it's a narrow view to think otherwise.
You're turn. 😉
--Jeff Moden
Change is inevitable... Change for the better is not.