• Jeff Moden (4/11/2013)


    opc.three (4/8/2013)


    If nuclear blasts were the only reason to leave xp_cmdshell disabled then you would have a great point. Unfortunately, that is simply too narrow a view.

    The circle continues so you've compelled me to say it again. If someone has SA privs, they can get to the command line whether xp_CmdShell is enabled or not. If someone doesn't have SA privs, they can't get to the command line whether xp_CmdShell is enabled or not. I believe it's a narrow view to think otherwise.

    You're turn. 😉

    I remember, gee, must be about 2 years ago now, on a similar thread when I tried to end the round-and-round with an "I'll agree to disagree." For whatever reason that idea did not seem amenable to you that day and I think you literally responded with something like "no, wait...", and proceeded to build more of a case in that followup post. At the time I had a suspicion that you thought I had some wrong thinking that you could simply correct with more dialogue. Hopefully it is clear at this point that we are just two people with different views on the same subject. It's funny too because I think we agree on almost all other topics where we have compared notes so in a way it's a shame we have spent so much time on this one.

    I have made several points surrounding security, auditability and application design explaining why one should not choose to use xp_cmdshell and I stand by those points. You stand by your points regarding members of the sysadmin Role, having your code be code consistent within backups, only needing to know one language with a sprinkle of cmd and Power shell, so here we are. Nowhere new, really, but maybe a bit more educated about each other's position. Hopefully others have benefited from our various dialogues as well. At present, as with before, and all along since that day 2 years ago really, I'll agree to disagree.

    There are no special teachers of virtue, because virtue is taught by the whole community.
    --Plato