Home Forums SQL Server 2008 Security (SS2K8) How to prevent ANY use of xp_CmdShell? RE: How to prevent ANY use of xp_CmdShell?

  • May 4, 2013 at 11:01 pm

    #1612446

    Ninja's_RGR'us (5/4/2013)

    Can you deny access to the windows account linked to sql server? That's how folders / files access works. .cmd is just an exe file AFAIK.

    If the file is part of the sql server install (which I doubt it is), you could just delete the file from the folder. Obviously don't delete the windows version, plenty of things still require it for the server to run correctly.

    No idea what happens if someone tries to activate access and run xp_cmdshell. That might get you anything from an error message to full catastrophic failure.

    Thanks Remi. I know you could delete the file back in SQL Server 2000 but I don't believe you can do that and still have an operational system anymore. Although I love the idea of denying the SQL Server Service login access to the file as you suggest, I don't know what will happen to such things as backups and backup file deletions. I'll have to try that on a test server.

    Thanks for the ideas. I appreciate your time.

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)