xp_cmdshell - Error 997 from GetProxyAccount on line 604

From: Anthony (anonymous_at_discussions.microsoft.com)
Date: 11/26/03 

Date: Wed, 26 Nov 2003 06:15:25 -0800

We try to execute xp_cmdshell from an non-sa SQL login ,
so we have to setup a domain proxy account for this
purpose, still when xp_cmdshell is executed, we got:

Error 997 from GetProxyAccount on line 604

We've done lots of tests, unless we put the service
account for MSSQLSERVER servcice as member of local Admin
group, then it works with NO problem

It seems that here is some contradiction to our basic
security principle, we tried to limit the no. of SQL login
with sa fixed server role ,therefore we only granted
explicit execution permission for xp_cmdshell to certain
SQL logins ; however, we have to put SQL service a/c into
local domain group, which may expose a higher risk to
buffer overrun vulnerabilty ...etc
Any comment..or same experience ?

Relevant Pages

  • Re: Rights to execute jobs?
    ... A Windows group cannot own a job and so, ... running with a created SQL Login seems okay to you I can detail the ... is that a group needs to not be an admin but still be able to execute any ... resource for job execution permissions. ...
    (microsoft.public.sqlserver.security)
  • Re: Strange error when Executing an SSIS package from a SQL Job
    ... user I use to log in to the server with, not the SQL login that I created ... that is set up to execute the job. ... I haven't seen this error before, but it does look like the package ...
    (microsoft.public.sqlserver.dts)
  • RE: add users in sql server using batch file
    ... You can use osql to execute your sql statements. ... sql login, while sp_grantLogin is used to add a windows login. ...
    (microsoft.public.sqlserver.server)