The xp_cmdshell extended stored procedure allows a Windows shell command to be executed from within a SQL Server connection. This command can be used for malicious purposes and is disabled by default in SQL Server. If the command is not being used, or if the use of the command can be eliminated, you can disable xp_cmdshell with this command:

exec sp_configure 'show advanced options',1

reconfigure

exec sp_configure 'xp_cmdshell',0

reconfigure


If xp_cmdshell must remain enabled in your environment, consider changing the proxy account used to execute the commands under in order to reduce risk using the sp_xp_cmdshell_proxy_account command. Full details of how to accomplish this are available at this link

  • No labels