Hello, I have run into something I never thought I would have to deal with. I have a developer that wants to execute xp_cmdshell from within a stored proc that executes from a sql server agent job step. I did not want to give the developer xp_cmdshell access but I did give her enough access to create sql server agent jobs. So I did some research and found that I can create an login that has the necessary access (CONTROL SERVER) and asked her to use the Execute AS clause in her proc and this worked as expected. However, this isn't quite enough, the cmdshell command is a bcp.exe that works from a shared folder, so what we found was that not only did the special cmdshell login need NTFS permissions, but the SQLServer Agent service account needed NTFS permissions as well as the owner of the job?? I tried to create a proxy account but that only works if the job step is a cmdexec type of job step and not if its a t-sql statement. I was expecting that the only NTFS permission to be applied would be that of the cmdshell login being used in the Execute As clause. clearly there is a disconnect of the security of some sort but I am not sure where that might be. In the meantime the developer can work, but now there is some extra knowledge that must be passed on regarding the NTFS permissions and how they must be for this job to run. Am I doing this correctly? could this be done better?
↧