Jeff Moden (3/30/2013)
Ok. So let's ask another question. To keep it simple, you've either been given administrative privs on a box or you are the administrator. You fire up PowerShell and drop hundreds of files from a file vault. What is logged?
It depends on what type of audit software is in place. You have the same options for auditing deleted OS files when the delete is initiated by PowerShell as you do when it is initiated by xp_cmdshell, except in the PowerShell scenario the logged event would show the actual user that initiated the delete and the xp_cmdshell event would appear to have been done by the SQL Server service account. If you try auditing the database activity in conjunction then I can show you a quick hack using a global temp table where the contents of the command sent into xp_cmdshell are hidden from the Trace.
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato