Permission to run master..xp_cmdshell

  • Hi!

    I have a user (SQL login), who has access to master database and the right to run xp_cmdshell via database role membership. When running it:

    SETUSER 'Smith'

    go

    exec master..xp_cmdshell 'dir c:'

    go

    SETUSER

    ===============================

    We get:

    Msg 50001, Level 1, State 50001

    xpsql.c: Error 997 from GetPassword on line 465

    When I give the user the sa server role, it works fine. I am not very happy to give so many users the sa role. Please help me to figure out, how to allow a user to run xp_cmdshell.

    /* I suspect that this is the consequenceså of a recent security patch installation (SQL2000-KB815495-8.00.0818-ENU.exe), since there were no complains about it before */

  • the sql login works fine without the 'sa' role.

  • What can be wrong with MS SQL 2000 (sp3) for this to happen?

  • not sure if it'lll work but give this a go...

    Management->SQL Server Agent (right click on this)->Job System, untick the "only users with sysadmin..." tick box.

    i could be well off the mark but let me know how you get on.

  • It asks for SQL Agent proxy account...

  • Execute permissions for xp_cmdshell default to members of the sysadmin fixed server role, but can be granted to other users.

    As Shoayb suggested, you can setup proxy account for those regular users who do not belong to 'sa' to execute xp_cmdshell under the proxy account context.

  • quote:


    As Shoayb suggested, you can setup proxy account for those regular users who do not belong to 'sa' to execute xp_cmdshell under the proxy account context.


    Set up proxy account, used the domain account, that SQL Server Service uses to log on. This account is in local administrators group. Get the same error:

    Msg 50001, Level 1, State 50001

    xpsql.c: Error 997 from GetPassword on line 465

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply