Exec XP_CMDSHELL cannot find store procedure problem

Question

I run EXEC sp_configure 'xp_cmdshell', 1
Message is"....change from 1 to 1 "
Then
EXECXP_CMDSHELL 'Dir N:'
cannot find store procedure xp_cmdshell
I check master database.
No dbo.xp_cmdshell under store procedure.
How to fix it? I need run command
EXECXP_CMDSHELL 'Dir N:'
Thanks

Answer 1

Hallo Bestrongself,
- what SQL Server version do you use?
- since SQL 2005 xp_cmdshell is located in the sys-schema and the procedure itself is located in the resource database of Microsoft SQL Server.
You can check xp_cmdshell by using the following command:
SELECT * FROM sys.all_objects WHERE name = 'XP_CMDSHELL'
I bet you will see it in the master database because you cannot drop system procedures and will return an error if you try to do so:
USE master;
GO
BEGIN TRANSACTION
DROP PROCEDURE dbo.xp_cmdshell;
DROP PROCEDURE sys.xp_cmdshell;
DROP PROCEDURE xp_cmdshell;
ROLLBACK TRANSACTION
To execute xp_cmdshell you need to have [CONTROL SERVER] permissions otherwise it won't work. Let's say I have a login which I grant exclusive permissions to execute xp_cmdshell it will fail!
USE master;
GO
-- create the login and the user in master-database
CREATE LOGIN test WITH PASSWORD = 'glmdpf12345', CHECK_POLICY = OFF, CHECK_EXPIRATION = OFF;
CREATE USER test FROM LOGIN [Test];
GO
-- grant explicit permission to execute the xp_cmdshell
GRANT EXECUTE ON sys.xp_cmdshell TO test;
GO
-- tryp to execute xp_cmdshell as test
EXECUTE AS login = 'test'
EXEC xp_cmdshell 'DIR C:';
REVERT
-- Housekeeping
REVOKE EXECUTE ON sys.xp_cmdshell TO test;
DROP USER 'test';
DROP LOGIN 'test';
As you can see from the above statement the login "Test" got exclusive permission to execute xp_cmdshell but the execution will fail with the following error message:
The xp_cmdshell proxy account information cannot be retrieved or is invalid. Verify that the '##xp_cmdshell_proxy_account##' credential exists and contains valid information.
The above error message is clear. Test is a "normal" user which has the permission to execute the proc BUT due to missing permissions to retrieve the information about the service account it fails!
You have to grant SERVER CONTROL to the account.
So - next step...
What is your permission on server level?
You can check your permissions by using the following statement:
-- what are my permissions on server level
-- check for CONTROL SERVER!
SELECT * FROM sys.fn_my_permissions (NULL, 'SERVER') ORDER BY permission_name;
-- what are my permissions for the object xp_cmdshell
SELECT * FROM sys.fn_my_permissions('xp_cmdshell', 'OBJECT');
Can you provide us with the results of the above query?
BTW: xp_cmdshell is a well documented statement and official command which is fully supported by Microsoft. You can find all information about functionality and security of xp_cmdshell here:
http://technet.microsoft.com/en-us/library/ms175046.aspx
MCM - SQL Server 2008
MCSE - SQL Server 2012
db Berater GmbH
SQL Server Blog (german only)