Using xp_cmdshell to run application that uses domain credentials

[byrocat]

I using MS SQLServer as a secure method of setting up system tasks and
processes for automated running. The intent is that all logins (ids
and passwords) are in a secure database table and are not sitting
around in batch files on the server.

Some of the tasks make use of network authentication, and this is where
the problem arises.

If I execute the command line from within SQLServer (via xp_cmdshell),
I get an error that says that the userid is missing. If I execute that
same command vid the CMD window, it works.

It appears that the shell that xp_cmdshell kicks off does not inherit
the domain authentication.

Aside from questions on why I am doing things this way as opposed to
using the windows scheduler or other tools, what do I need to do to
make sure that my domain credentials are passed?

[Erland Sommarskog]

byrocat (bd******@sympatico.ca) writes:

I using MS SQLServer as a secure method of setting up system tasks and
processes for automated running. The intent is that all logins (ids
and passwords) are in a secure database table and are not sitting
around in batch files on the server.

Some of the tasks make use of network authentication, and this is where
the problem arises.

If I execute the command line from within SQLServer (via xp_cmdshell),
I get an error that says that the userid is missing. If I execute that
same command vid the CMD window, it works.

It appears that the shell that xp_cmdshell kicks off does not inherit
the domain authentication.

Aside from questions on why I am doing things this way as opposed to
using the windows scheduler or other tools, what do I need to do to
make sure that my domain credentials are passed?

What account does SQL Server run? It sounds like it's running under
Local System, which is not good for network access.

Overall, the whole thing sounds messy to me. The Windows user will be
the service account for SQL Server, which may not give the results
you wanted.

An alternative would be to have a client program that runs on the
SQL server machine and retrieves the passwords and then runs the programs.
Important is that connection is over shared memory, so that no intruder can
eavesdrop on the connection.

--
Erland Sommarskog, SQL Server MVP, es****@sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pro...ads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinf...ons/books.mspx