CODEWITHSUNDEEP
sqlpermission-deniedxp-cmdshell
Sharles Phirans
Sharles Phirans

Reputation: 93

permission was denied on the object xp_cmdshell

I am getting Execute permission was denied on the object 'xp_cmdshell'.

Here's the situation, I have a stored procedure called ExportFile. I am calling the stored procedure via SqlCommand from a web application from a Virtual PC.. during the execution of this command i get permission error

Then I debug it via SQL profiler and execute the result from the profiler to a query window (this means i run the StoredProcedure with the necessary parameters basing from the profiler to a Query window) and surprisingly its working just fine. the file was exported successfully.

I wonder whats wrong with this considering that my login in the connection string is an owner and admin user.

Upvotes: 1

Views: 14097

Answers (3)

MovGP0
MovGP0

Reputation: 7783

Assuming you get a message like 

The EXECUTE permission was denied on the object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.

Then you first need a proxy user which SQL Server uses to access the host operating system.

  1. Setup the proxy user
execute sp_xp_cmdshell_proxy_account 'DOMAIN\USER', 'PASSWORD'

In SQL Server Management Studio this should look like the following:

Proxy user in SSMS

  1. Ensure that the SQL user (not the proxy user) is mapped to the master database
use [master]
go

execute sp_addrolemember 'public', SQLUSERNAME;
execute sp_addrolemember 'db_datareader', SQLUSERNAME;
execute sp_addrolemember 'db_datawriter', SQLUSERNAME;

In SQL Server Management Studio, this should look like this:

User permissions is SSMS

  1. Grant the execute permission, such that the SQL user can use the proxy to access OS functionality
use [master]
go

grant execute on xp_cmdshell to SQLUSERNAME

Upvotes: 1

Saurabh Sinha
Saurabh Sinha

Reputation: 1373

We have to give this user execute permission

Syntax: 

GRANT EXECUTE ON xp_cmdshell TO [Domain\User]

Note : Make sure you must be using login on which you give execute permission. I found many times user do use diff id and complain.

Upvotes: 1

Phil
Phil

Reputation: 56

The SQL user account being used with the web server doesn't have permissions to use that extended procedure. You would have to elevate the rights of that user (bad idea) or assign a proxy account within SQL security that can execute the procedure within the server without making the web account a Sysadmin.

Upvotes: 4

Related Questions