is there a way to know who and when and what program to disable xp_cmdshell

Question

is there a way to know who and when and what program to disable xp_cmdshell

ying.wang

Mr or Mrs. 500

Points: 521
More actions
November 19, 2014 at 4:21 pm

#298828

Hello,
I enabled xp_cmdshell feature in my sql server 2012 instance but it seems it automatically disabled in the evening. How to I know who and when and what program to disable xp_cmdshell feature?
Thanks for your help!

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply

Jeff Moden SSC Guru Points: 1004441 More actions · Answer 1

If you have the "Default Trace" running (and you should if you don't, it's on by default though), the following should do with the understanding that you get to pick which columns you want to see for something like this...

SELECT tr.*

FROM sys.fn_trace_gettable

(CONVERT(VARCHAR(500),

( --=== Locate the default trace

SELECT TOP 1 [value]

FROM sys.fn_trace_getinfo(NULL)

WHERE property = 2

)

), DEFAULT) tr

WHERE tr.TextData LIKE '%Configuration%xp_CmdShell%1 to 0%'

ORDER BY tr.StartTime DESC

;

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

ying.wang Mr or Mrs. 500 Points: 521 More actions · Answer 2

SELECT tr.*

FROM sys.fn_trace_gettable

(CONVERT(VARCHAR(500),

( --=== Locate the default trace

SELECT TOP 1 [value]

FROM sys.fn_trace_getinfo(NULL)

WHERE property = 2

)

), DEFAULT) tr

WHERE tr.TextData LIKE '%xp_cmdshell%'

ORDER BY tr.StartTime DESC

;

above script works for me.

Thanks very much!

Jeff Moden SSC Guru Points: 1004441 More actions · Answer 3

Very cool. Thank you for the feedback. Just be aware that will also find usage and not just the instances where someone turned it off.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)