2

A T-SQL script is running an xp_cmdshell call to stop a local service through Powershell's Stop-Service, say, like this:

exec xp_cmdshell 'powershell Stop-Service -InputObject (get-Service -Include *"MyService"*)'

Now, since the current login is sysadmin, it is being ran under SQL Server's service's account, which is a local account without admin rights. In that case the Stop-Service fails due to lacking access. Then, if I add the SQL Server's account to Administrators group, the only way I can make this change effective is to restart SQL Server's service. Is there any other way to do this without having to restart the sql server? Thank you!

PS. I know xp_cmdshell is bad for you, let's please not focus on that.

Improve this question

1 Answer 1

Reset to default
2

Depending on how secure you want to make it (Not dwelling on it as you've requested), a proxy account could be setup for xp_cmdshell operations so that it does has local admin.

xp_cmdshell_proxy

Since you're interacting with the OS at this point, you could also create scripts to switch execution context to another user either through powershell or through the normal command line.

Obviously this all depends on who has access to SQL Server and Agent, and if it would be an issue. Only you can answer that.

Improve this answer
1
  • Would xp_cmdshell_proxy be used even though the current login is sysadmin? Documentation is slightly unclear about that. Will have to try that tomorrow, for educational purposes. Other than that, thanks for the idea! I am not really looking for a solution requiring any typing (i.e. we don't really want to change the setup, there will eventually be a possibility to restart). I was just imagining that maybe there is some sort of magic word like reconfigure - when new values would be pulled in... or something like that.
    – Yuri Makassiouk
    Jul 4, 2014 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.