I'm trying to restricting
CmdExec rights to sysadmin server role in SQL Server 2012. I've googled but just found some solution which they were for older version of SQL Server. Can you please help?
I don't believe there is any way to restrict this other than monitoring for it. I generally don't want sysadmins (or local server admins) running jobs. Where possible, I use proxy accounts with minimal required permissions. You can run the below to find what is lurking about now as proxies. If you are not using a proxy, the job will be running under the agent service account.
USE MSDB GO EXEC SP_ENUM_PROXY_FOR_SUBSYSTEM @subsystem_name = 'CmdExec' GO