Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2000 Forums
 SQL Server Development (2000)
 Avoiding xp_cmdshell

Author  Topic 

vgr.raju
Yak Posting Veteran

95 Posts

Posted - 2006-06-21 : 04:01:09
Hello Experts,
I am coding the SQL job,in which I am copying the file from external share to the local machine and the doing the Bcp.
I am using the XP_CMDSHELL Extended stored procedure to do the copy and then invoke the 'BCP' Process.My concern is XP_CMDSHELL requires the admin Privileages and makes me feel less secure about the application.
Is there any other way I can do the copy and Bcp process inside the stored procedure without using XP_CMDSHELL extended stored procedure.
I just want to use the least privileaged account for running the SQL jobs.

Any help and pointers would be greatly appreciated..
Thanks in advance.

nr
SQLTeam MVY

12543 Posts

Posted - 2006-06-21 : 04:30:59
you can use bulk insert instead of bcp.
For the copy you can use the FileSystemObject.

xp_cmdshell doesn't need admin priviledges as you can use a proxy for other users.

==========================================
Cursors are useful if you don't know sql.
DTS can be used in a similar way.
Beer is not cold and it isn't fizzy.
Go to Top of Page

SreenivasBora
Posting Yak Master

164 Posts

Posted - 2006-06-21 : 17:49:22
Hey Raju,

Good Question. This can be resolved in 2 ways

Dont give System admin permissions to user.

1. Use a Proxy account and use that account for running of these kind of jobs (xp_cmdshell or xp_Sendmail ect)
2. remove system admin permission for the user and goto master --> stored procs --> give execute permissions on xp_cmdshell for that partcular user. This will work.

Regards
Sreenivas

With Regards
BSR
Go to Top of Page
   

- Advertisement -