Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 Transact-SQL (2005)
 What are the disadvantages of enabling xp_cmdshell

Author  Topic 

pras2007
Posting Yak Master

216 Posts

Posted - 2010-04-05 : 08:28:34
Hello All,

I need to enable the xp_cmdshell feature in SQL Server 2005, and I would like to know the disadvantages of doing so.

Please advice.

Thanks.

pk_bohra
Master Smack Fu Yak Hacker

1182 Posts

Posted - 2010-04-05 : 08:39:21
One disadvantage i know is:

It will allow the user to execute dos based command.(Depending upon the permission granted to user )

Using dos based command,a file from server can be copied , deleted. etc..

Regards,
Bohra
I am here to learn from masters and help new bees in learning.
Go to Top of Page

pk_bohra
Master Smack Fu Yak Hacker

1182 Posts

Posted - 2010-04-05 : 08:41:27
I know there must be a need for enabling the command.
Can you tell us the neccessity of enabling the xp_cmd shell feature. May the task u want to do may be possible the other way also.

Regards,
Bohra
I am here to learn from masters and help new bees in learning.
Go to Top of Page

pras2007
Posting Yak Master

216 Posts

Posted - 2010-04-05 : 08:50:40
Thanks for the response pk_bohra, I want to be able to do the following:

- Zip backup files
- Delete old backup file

Go to Top of Page

pk_bohra
Master Smack Fu Yak Hacker

1182 Posts

Posted - 2010-04-05 : 09:09:13
You can write a CLR function to perform this task in vb.net and register the assembly in the sql server.
Then you can make a call to dll from sql server.

I never tried it but i feel it should be possible.

Refer the below link for more information on CLR :
http://msdn.microsoft.com/en-us/library/ms345136(SQL.90).aspx


Regards,
Bohra

I am here to learn from Masters and help new bees in learning.

Go to Top of Page

visakh16
Very Important crosS Applying yaK Herder

52326 Posts

Posted - 2010-04-05 : 09:58:45
or you can use ssis also for doing both

http://www.sqlservercentral.com/articles/Integration+Services+(SSIS)/64028/
http://social.msdn.microsoft.com/Forums/en/sqlintegrationservices/thread/a8dfcc51-15df-4eaa-9345-10ae4c4e9673

------------------------------------------------------------------------------------------------------
SQL Server MVP
http://visakhm.blogspot.com/

Go to Top of Page
   

- Advertisement -