peleg (3/29/2013)
why to use xp_cmdshell when you have the ability to write assembly it NET, more then that, that can be signed and give a higher level of security?we are not on sql2000, so why the reason to use it?
Let's turn it around? Why write .NET code and go through the time of testing, issues with bugs, deployment across many machines, including in DR situations when xp_cmdshell can allow you the flexibility to handle multiple issues?
I'd also point out you are assuming there are skills in place to do this. Lots of very good DBAs are not .NET developers? do you want them spending time learning this? Or spending their time building code that might be secure? Or downloading something from the Internet and compiling/deploying this to servers?
Enabling the CLR also means enabling is globally, potentially a problem when you don't want unsafe code running in other parts of your system.