RE: Developers/Production Security
From: Alvin Zhao[MSFT] (alvinzh@online.microsoft.com)
Date: 03/20/03
- Next message: Vinodk: "Re: Stored Procedure Question"
- Previous message: Leon Parker: "Stored Procedure Question"
- In reply to: Marc Miller: "Developers/Production Security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: alvinzh@online.microsoft.com (Alvin Zhao[MSFT]) Date: Thu, 20 Mar 2003 02:16:26 GMT
Hi Marc,
When you connect to SQL Server in your program, you connect with a userid
and password, which is the security context that you use to access SQL
Server. You use this userid to perform all the server operation. When the
user is a member of sysadmin, the program will execute extended stored
procedure like xp_cmdshell in the security context of the account that
starts SQL Server service. If the user is not a member of sysadmin, it
executes xp_cmdshell in the context of another local account,
SQLAgentCmdExec, and not the SQL Server logon account. You can set
permissions on the SQLAgentCmdExec account accordingly. To run xp_cmdshell
for a non-system administrator user, you must grant the following rights.
MSSQLServer and SQLServerAgent Services
- Act as part of the Operating System.
- Increase Quotas.
- Replace a process level token.
- Log on as a batch job.
SQLAgentCmdExec Account
- Log on as a batch job.
You must restart the entire server, not just the SQL Services, in order for
any changes made to user rights permissions to take effect.
Sincerely,
Alvin Zhao
Microsoft Support
This posting is provided "AS IS" with no warranties, and confers no rights.
- Next message: Vinodk: "Re: Stored Procedure Question"
- Previous message: Leon Parker: "Stored Procedure Question"
- In reply to: Marc Miller: "Developers/Production Security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
