1

I'm trying to restricting CmdExec rights to sysadmin server role in SQL Server 2012. I've googled but just found some solution which they were for older version of SQL Server. Can you please help?

Improve this question
3
  • Do you mean cmdexec in the context of a SQL Agent job? Or xp_cmdshellwhich can be run from any old TSQL query?
    – LowlyDBA - John M
    Jul 27, 2015 at 14:30
  • @JohnM exactly, I mean cmdexec in the context of SQL Agent
    – mhesabi
    Jul 28, 2015 at 3:30
  • @mhesabi - are you trying to make it so only members of the sysadmin role can create SQL Server Agent Job Steps that use CmdExec ?
    – Hannah Vernon ♦
    Sep 9, 2015 at 15:48

1 Answer 1

Reset to default
0

I don't believe there is any way to restrict this other than monitoring for it. I generally don't want sysadmins (or local server admins) running jobs. Where possible, I use proxy accounts with minimal required permissions. You can run the below to find what is lurking about now as proxies. If you are not using a proxy, the job will be running under the agent service account.

USE MSDB
GO
EXEC SP_ENUM_PROXY_FOR_SUBSYSTEM @subsystem_name = 'CmdExec'
GO
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.