SQL Server xp_cmdshell: account's access changed - how to avoid restarting the service?

Question

A T-SQL script is running an xp_cmdshell call to stop a local service through Powershell's Stop-Service, say, like this:

exec xp_cmdshell 'powershell Stop-Service -InputObject (get-Service -Include *"MyService"*)'

Now, since the current login is sysadmin, it is being ran under SQL Server's service's account, which is a local account without admin rights. In that case the Stop-Service fails due to lacking access. Then, if I add the SQL Server's account to Administrators group, the only way I can make this change effective is to restart SQL Server's service. Is there any other way to do this without having to restart the sql server? Thank you!

PS. I know xp_cmdshell is bad for you, let's please not focus on that.

Answer 1

Depending on how secure you want to make it (Not dwelling on it as you've requested), a proxy account could be setup for xp_cmdshell operations so that it does has local admin.

xp_cmdshell_proxy

Since you're interacting with the OS at this point, you could also create scripts to switch execution context to another user either through powershell or through the normal command line.

Obviously this all depends on who has access to SQL Server and Agent, and if it would be an issue. Only you can answer that.