opc.three (6/12/2013)
I already did.
http://www.sqlservercentral.com/Forums/FindPost1450182.aspx
I showed how to recognize that a call to the cmd shell was being made within Windows using WMI. Granted, that exercise only detected the occurrence to report it, but intercepting the call and turning it away based on whether the parent process was the sqlsrvr.exe is no doubt possible.
My apologies. This is the first I've seen that post. I flat out missed it because of all the emails I get. Thanks for taking the time.
Still, we're in the should-be-possible mode. It would be nice to see and test the code that actually does the job and then see if things like backups from SQL Server will still work.
It would also be nice if someone finished the VB script example.
--Jeff Moden
Change is inevitable... Change for the better is not.