SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security conf - sql

We have enabled 'XPCmdShellEnabled' on the database serve and we used command shell script in one of the SP which executes on daily job.
(Our Command shell script basically create the directory, create the file and dump the tem table data to csv file).
Issue: From past few days the daily job filing with the below error, before that it was working fine and nobody changed any configurations on server.
SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell' search for 'xp_cmdshell' in SQL Server Books Online.
(We have enabled 'XPCmdShellEnabled' = true on 'Surface Area Configuration'.
I have tried again by executing below query, and tried SP.
sp_configure 'show advanced options', '1'
RECONFIGURE
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
But no luck..
Please let me know if anybody aware/faced of this similar type of issue and found solution.
Thanks.

Related

How to Enable Create catalog Option in Integration Services Catalogs?

I want to create a SSIS catalog and the way to create a catalog is to right click on "Integration Services Catalogs" node and select "Create Catalog" option.
But "Create Catalog" option is disable , how to enable this option ?
To check if SSIS installed, open Sql Server Configuration Manager, in the SQL Server Services, is something like 'SQL Server Integration Services ' running?
I had this problem and I found the above solution in belew link:
Can't create a SSISDB catalog due to missing SSISDBBackup.bak file, even though SSIS is installed
Sp_configure 'show advanced options',1;
Go
Reconfigure;
Go
Sp_configure 'clr enabled',1;
Go
Reconfigure
Go
Run the above command from master database

FILESTREAM feature is disabled

I have a database set up with FILESTREAM enabled on it (if you go to Properties\Advanced on the instance, it shows that FILESTREAM is enabled). I also ran the sp_configure script on it after doing this to enable the access (to make sure it was enabled). But...as soon as I try to alter the database and add the filegroup to it, it says that the feature is disabled.
I have it enabled on other instances on the same computer, and those work fine. It is only this one that is not working. I have not been able to find any good suggestions as to why it is not working.
It is a SQL 2008 R2 instance.
I was unable to script this, (using the link provided by user1977061), as the MSSQLService requires a restart afterwards to apply the change. Even after doing this it didn't work, and instead I had to manually configure FILESTREAM usage via:
SqlServer Configuration Manager
Sql SQL Server Services
SQL Server(MSSQLSERVER) [Properties]
FILESTREAM tab - enable the first 2, and optionally 3rd check box.
Look at the SQLServer properties > Advanced > Running Values value for "Filestream Access Level" to ensure that the FILESTREAM is actually enabled if in doubt.
Was FILESTREAM enabled on the instance level, though?
In Microsoft Sql Server Management Studio, right-click the server and select Properties. Then on the Advanced page, ensure that FILESTREAM Access Level is not set to Disabled (Which I believe is default):
Changing the FILESTREAM settings through SQL Server Management Studio -> Properties -> Advanced had no effect for me, and SQL Server Configuration Manager kept giving me an error when I enabled FILESTREAM there:
There was an unknown error applying the FILESTREAM settings.
Check the parameters are valid. (0x80041008)
Digging around on the internet led me here as well as to this page: https://social.msdn.microsoft.com/forums/sqlserver/en-US/d8060fdd-4583-4bf7-bdcf-4fd053d5d2c0/unknown-error-applying-the-filestream-settings
Fortunately one of the suggestions there was the solution. Connect to the server with SQL Server Management Studio and run this script:
sp_configure 'filestream access level', 2
reconfigure with override
Note: This was for 64-bit SQL Server 2012
For me this worked out:
forget about Microsoft SQL Server Management Studio to solve this bug
find SQLServerManager**.msc in folder C:\Windows\SysWOW64 and open it
enable filestream as in the picture, by clicking on properties
Database import should work then!
I've done this a thousand times and always follow the steps as Mojo outlines above. However I found that on one computer I couldn't get this to work unless I changed SQL Server Service from running as NT Service to running under a local account. I even reinstalled SQL Server, no luck.
I did as follows:
Click start
Type 'compmgmt.msc'
Expand 'Services and Applications'
Sql Server Configuration
Right Click on 'SQL Server (MSSQLSERVER)' and choose 'Properties'
On the Log On tab, change the user to a local account
Maybe one day this will save someone from banging their head on their desk until their eyeballs pop-out.
If you still are having problems with this i suggest you checkout this link!
I had the same problem in which only one instance didn't activate filestream properly. The solution seems to be to use the SQL Server Configuration Manager and enable it from there.
In addition to the other answers: the account that is used by the sql server service must be a member of the Administrators group.
Symptom: the "Configured value" in the server properties does show "enabled", but the "Running value" stays at "disabled".
I got this working by enabling filestream not in SQL Management Studio but in SQL Configuration Manager. See https://learn.microsoft.com/en-us/sql/relational-databases/blob/enable-and-configure-filestream?view=sql-server-2017.
On the Start menu, point to All Programs, point to SQL Server, point to Configuration Tools, and then click SQL Server Configuration Manager.
In the list of services, right-click SQL Server Services, and then click Open.
In the SQL Server Configuration Manager snap-in, locate the instance of SQL Server on which you want to enable FILESTREAM.
Right-click the instance, and then click Properties.
In the SQL Server Properties dialog box, click the FILESTREAM tab.
Select the Enable FILESTREAM for Transact-SQL access check box.
If you want to read and write FILESTREAM data from Windows, click Enable FILESTREAM for file I/O streaming access. Enter the name of the Windows share in the Windows Share Name box.
If remote clients must access the FILESTREAM data that is stored on this share, select Allow remote clients to have streaming access to FILESTREAM data.
Click Apply.
In SQL Server Management Studio, click New Query to display the Query Editor.
In Query Editor, enter the following Transact-SQL code:
SQL
Copy
EXEC sp_configure filestream_access_level, 2
RECONFIGURE
Click Execute.
Restart the SQL Server service.
For me only the combination of SchmitzIT and Mojo suggestions made it work
I also stumbled into this problem and by trial and error i found out that the solution was to change the account under which Sql Server runs so from SS Configuration manager i located the sql server instante, right clicked "Properties" and on the "LOg On" tab i changed Logon as "This account" to "Bulil-in account", where i choose "Local system".
After a service restart all went fine.

Cannot initialize the data source object of OLE DB provider "Microsoft.ACE.OLEDB.12.0" for linked server

I'm trying to establish a linked server from SQL Server 2008 R2 to an Access database. The Access database is not password protected. As I have seen in other posts (specifically this one), this is usually due to the current user not having access to the Temp folder inside the NetworkService folder. Since we are running this in Windows Server 2008, the directory structure is quite different than what most are eluding to. I have allowed access to every temp folder in the "root:\Documents and Settings\" directory, and to no avail.
This is the procedure I am using to add the linked server:
EXEC sp_addlinkedserver
#server = N'OS_Access',
#provider = N'Microsoft.ACE.OLEDB.12.0',
#srvproduct = N'',
#datasrc = N'C:\RTBData\Data\OS.mdb';
GO
It creates the linked server with no problem, but I am not able to view the tables/views of the database. Likewise, my ASP.NET application cannot access it either.
I have tried both ACE and JET(64-bit)(by installing the Data Connectivity Components for Office), and they both do not work. I have also tried configuring the ACE provider with "Dynamic Parameter" and "Allow InProcess" to true.
Additionally, I tried upping the memory usage by the MSSQLSERVER services by adding "-g512;" in front of "startup parameters" string in SQL configuration manager to rule out memory issues.
If anyone could shed some light on this that would be fantastic! Thanks!
UPDATE: I logged into SQL using the sa account, and I was able to view the linked server. My current user account has full permissions in SQL server, so I am unsure of what the difference is between the accounts. Maybe I gave permissions to the wrong Temp folder, in which the sa account (being built-in) has access to. If someone could point me in the right direction here, that would be great, and I think it would also help a lot of other people.
I fixed the problem by disabling UAC within the control panel. I am unsure what changes this made, but it might help others!
USE [master]
GO
EXEC sp_configure 'show advanced options', 1
RECONFIGURE
GO
EXEC sp_configure 'ad hoc distributed queries', 1
RECONFIGURE
GO
USE [master]
GO
EXEC master . dbo. sp_MSset_oledb_prop N'Microsoft.ACE.OLEDB.12.0' , N'AllowInProcess' , 1
GO
EXEC master . dbo. sp_MSset_oledb_prop N'Microsoft.ACE.OLEDB.12.0' , N'DynamicParameters' , 1
GO
SELECT *
FROM OPENROWSET('Microsoft.ACE.OLEDB.12.0','Name & Location of DB';;, [TableName])

SQL xp_cmdshell copy files between servers

I am trying to move all .zip in a specific folder to another folder. the source folder is located on another server, currently i am using
EXECUTE xp_cmdshell 'copy \\server1\e$\ETL\*.zip \\server2\e$\ETL\'
GO
Which is working if I am logged into both server, but the goal is to automate this process VIA sql server job agent. I have tried
EXECUTE sp_xp_cmdshell_proxy_account 'domain\useracc','pass'
GO
EXECUTE xp_cmdshell 'copy \\server1\e$\ETL\*.zip \\server2\e$\ETL\'
GO
but I am receiving the following error;
An error occurred during the execution of sp_xp_cmdshell_proxy_account. Possible reasons: the provided account was invalid or the '##xp_cmdshell_proxy_account##' credential could not be created. Error code: '0'.
And also not sure if this is my solution. Please help with how I can achieve this. The file names on server1 change name and quantity everyday.
I would strongly advise...Do not use xp_cmdshell. It opens up large security wholes in your surface area and makes you vulnerable to attack. xp_cmdshell should be disabled!
Instead, if you want to automate this with server agent you have 2 options. My preference would be to write a simple SSIS package with a file system task and schedule this package with server agent. SSIS is underutilized for this kind of task but is actually pretty good at it.
Alternatively re-write your script to use Server Agent CmdExec job steps. This does not require xp_cmdshell to be enabled and reduces the attack surface.
I Found that the following worked for me;
In the command prompt, type services.msc, this would open the list of all services on the server.
In the list of services, look for SQL Server Agent, Right Click -> Properties. Go to Logon Tab
Change the logon to a user with access on both servers. then re-write your script to use Server Agent CmdExec job steps(Thank you Pete Carter)

SQL Server 2008 Error 233

I'm creating new login in SQL Server 2008 with following sql script:
CREATE LOGIN [xyz] WITH PASSWORD='xyz',
DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english],
CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
It creates new login successfully. But when I try to login with it using SQL Server Management Studio it fails saying:
A connection was successfully established with the server, but then an error occurred during the login process. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.) (Microsoft SQL Server, Error: 233)
What's wrong? How do I solve this issue?
Here is how I done it, maybe it works for you too.
login Microsoft SQL Server 2012 with windows authentication.
right-click onto the server name in Object Explorer and click Properties
In the new tab click Security
select SQL Server and Windows Authentication
Ok
Close the SQL server management studio.
start+run
write services.msc
search for SQL there and restart all services.
that works for me.
It's also possible that you're trying to use SQL Server Authentication without having enabled it. To fix this, right-click Properties on your server instance in SQL Server Management Studio, and update the security settings to include "SQL Server and Windows Authentication mode".
Looks like you're trying to connect using named pipes, but SQL Server is not listening on that protocol. See MSDN.
The two fixes MSDN suggests are:
Connect using TCP/IP, or use the SQL
Server Configuration Manager to
enable remote connections using named
pipes.
Using SQL Server Configuration
Manager on the client computer, move
TCP before named pipes in the
protocol order list.
I had a similar issue:
1. log in as the master user or windows authenticated user.
2. right click on the database --> properties --> security -->
3. change Windows Authentication mode to "SQL server and windows authentication mode" by clicking on the radio button. (if it is not)
4. restart the server
I had the same issue when i first setup SQL Server 2014 on my local machine.
In my case the solution was to set a correct defualt database.
Login with Administrator in SQL Server
Go to Securities >> Logins >> select your user name and go to properties
From Status >> uncheck user account lock check box
Change password for the user
Restart the sql server and login with your username.
I was facing the same error.
I've resolved the error by following below mentioned steps:
Disable named pipes and restart sql services.
After restart sql server I enabled names pipes and did a sql server restart again (Link for Step 1 and 2)
Connect to SQL server via studio.
Right click on SQL instance --> Properties --> Connections --> "Set the Maximum number of 5. concurrent connections to '0' ".
Save the change.
Restart the SQL server if possible. (Link for step 3 to 6)
I hope this will help someone
This is might not be a connection issue . Check your default database and if that is online . More commonly this issues seen when the default database will be offline or not exists . If your default database other than master ,better check this option.
I got a way to go around the problem.
Open one instance and login using the windows authentication
allow sql and windows auth both by right cliking on the db server.
Open second instance and login using sql authentication.
bingo the sql authenticated instance open .. :)
Actually in this way we cheat the sql authenticated instance as it tries to find an already running instance.. worked fr me.. good luck
I tried most of the solution but was not able to solve it until I found this URL which says to do the following:
Open SQL Server Management Studio and run the these queries:
sp_configure 'show advanced options', 1;
go
reconfigure
go
sp_configure 'user connections', 0
go
reconfigure
go
The reason why we got this error is that the user connections was reset to 1, so only one user was able to connect with the SQL server.
just a simple query worked for. I hope this will work for others as well.
I have not used the script style, but login through GUI I encountered the same error code. I had entered wrong user name and this is why I was getting the Sql Server, Error: 233. In order to resolve this, you should input the following information:
Server Name: MachineName\SQLEXPRESS
Authentication: SqlServer Authentication
User Name: Assigned user-name or simply sa
Password: xyzpqr
NOTE: Here I have wrote above data for demo purpose only, actual data is your machine & software's properties.
According to: https://msdn.microsoft.com/en-us/library/bb326280.aspx
Go to --> Remot setting
Go to "Remote" tab
in "Remote Assistance", Tick "Allow Remote Assistance connection to this computer", Click the "Advance" button and tick the "Allow..." and in the "Invitation" set the "30 days"
Then in the "Remote Desktop" part
Just tick "Allow remote connection to this computer"
After following the examples here and still not getting in, I found that my sa login was disabled. The following got me in:
Logged back in under windows authentication.
Expanded Security Tab
Expanded Logins Tab
Right-clicked sa and selected Properties
Went to the Status Tab
Under Login: Clicked 'Enabled' radio
Restarted Server and logged in as sa.
This assumes you have set sa password already using
ALTER LOGIN sa WITH PASSWORD = '<enterStrongPasswordHere>' ;
"A connection was successfully established with the server, but then an error occurred during the login process."
I was getting this problem from sqllocaldb when used from within Docker. The problem was the Docker image was not allocated enough memory. Increasing the memory actually fixed the problem.