Xp_cmdshell From IIS: Proxy Not Working
Oct 3, 2007
I have a procedure which prepares a csv file on demand using xp_cmdshell to invoke bcp.
It works fine in sql server. In fact, I have setup a proxy account to run as the domain administrator so it should even work for limited sql server accounts.
When IIS 6.0 attempts to run the procedure, however, I get "xp_cmdshell failed to execute because current security context is not sysadmin and proxy acount is not setup correctly."
For some reason, IIS 6.0 is not able to assume proxy privileges.
Recently, the machine hosting IIS was promoted to a domain controller. Is this causing a problem? My suspicion is that the proxy account has to be a LOCAL user, and since DC's do not have local users, the proxy privileges are useless.
Anybody got any thoughts?
Thanks.
View 9 Replies
ADVERTISEMENT
Oct 4, 2007
Re: SQL Server 2005
Does the xp_cmdshell proxy account need admin-level permissions on the server?
The reason I ask this is because I keep getting "Access is Denied" errors when trying to run this command as a non-admin:
master..xp_cmdshell dtexec 'some package'
The 'some package' has an "execute process task" which calls a batch file on the server.
If the proxy account is NOT a local admin, the "execute process tasks" fails with an "Access is Denied" error.
If the proxy account is a local admin, it executes fine.
We have given "Everyone" FULL CONTROL of all the folders that are affected by the batch file, and it still does not work.
I am out of ideas at this point. It just does not work unless it's an admin.
Are we missing something here?
View 7 Replies
View Related
Mar 2, 2004
Hi all, i hope you can help me.
Basically a dts package has been setup that pulls in data from another companies server, this data requires to be on-demand i.e individual users can pull in updates of the data when they require it.
I am using xp_cmdshell and dtsrun to pull in the data. This obviouly works fine for me as i am a member of sysadmin.
Books online quotes " SQL Server Agent proxy accounts allow SQL Server users who do not belong to the sysadmin fixed server role to execute xp_cmdshell"
So i went to the SQL Server Agent Properties 'Job System' tab and unchecked 'Non-sysadmin job step proxy account' and entered a proxy account.
The proxy account has been setup as a Windows user with local administrator privilages and even a member of the sysadmin server role - just in case.
Now when i log onto the db with my test account - a non-sysadmin - and attempt to run the stored proc to import the data i recieved the message 'EXECUTE permission denied on object 'xp_cmdshell', database 'master', owner 'dbo' '
hmm... so basically i have either misunderstood BoL or there is something not quite right in my setup.
I have search the net for a few days now and yet i can find no solution.
Can anyone help?
View 2 Replies
View Related
Jul 9, 2007
Hi All,
When I was trying to execute an SSIS package from DTExec using xp_cmdShell, it is giving an error message saying "unrecognized command,...". This error I am getting only in my Staging Environment. But at the same time, it is working fine with Development and Production servers.
I suspect the issue should be with config or access issues. So if anyone of you faced the same problem or if anyone have any solution, please share with me.
Thanks in advance for your help.
Thanks & Regards,
Prakash Srinivasan
View 1 Replies
View Related
Jun 18, 2008
Hi,
I'm just moving over one of our databases from SQL2000 to 2005. Everything is working fine, and all web sites are working, however I just can't seem to get xp_cmdshell to function on the 2005 server.
I have enabled xp_cmdshell, and when I run a stored procedure, which writes the contents of one column to a text file, it says "invalid object name". This table is definitely there, and is actually updated earlier on in the same SP, so permissions for that are fine.
This is the line causing the problem (if I take it out, the rest of the SP works no problems):
--write the text file
EXEC master.sys.xp_cmdshell 'bcp "SELECT newslettertext FROM mydatabase.dbo.newsletters" queryout D:ewslettertext extbody.txt -U -P -c'
Error = [Microsoft][ODBC SQL Server Driver][SQL Server]Invalid object name 'mydatabase.dbo.newsletters'.
SQLState = 37000, NativeError = 8180
Error = [Microsoft][ODBC SQL Server Driver][SQL Server]Statement(s) could not be prepared.
NULL
Could it be to do with permissions on the master.sys.xp_cmdshell? If so, wouldn't it give me a "permission denied" error?
Any help would be greatly appreciated!
Thanks
View 6 Replies
View Related
Jan 20, 2004
I am having problem creating/copying "txt" file in a remote machine by using the "exec master..xp_cmdshell" command in query analyzer. For example, we are getting errors for the following command:
exec master..xp_cmdshell 'copy d: estingauthors.txt \<MyServerName><myFolderName>authors.txt'
(but exec master..xp_cmdshell 'copy d: estingauthors.txt d: esting1authors1.txt' is working without any problems)
Any ideas?
View 7 Replies
View Related
Jan 20, 2004
I am having problem creating/copying "txt" file in a remote machine by using the "exec master..xp_cmdshell" command in query analyzer. For example, we are getting errors for the following command:
exec master..xp_cmdshell 'copy d: estingauthors.txt \<MyServerName><myFolderName>authors.txt'
(but exec master..xp_cmdshell 'copy d: estingauthors.txt d: esting1authors1.txt' is working without any problems)
Any ideas?
View 2 Replies
View Related
May 15, 2007
I have read all the posts regarding this error, but non-solve my problem as I had already addressed them.
I am setting up Merge Replication via the Web and I get this error when i try to sync. Let me give you some background.
I wrote a small windows test app to test merge replication, in which i am using RMO to accomplish the replication. This works. It syncs every time. I then copied the "sync" code from the winform application and created a Windows Service in which i placed "sync" code. The sync code did not change other than adding the additional following four lines:
_mergeAgent.InternetUrl = _internetURL;
_mergeAgent.InternetLogin = _internetLogin;
_mergeAgent.InternetPassword = _internetPassword;
_mergeAgent.InternetTimeout = _internetTimout;
where the internet url is https://ipaddress/virtualdirectory/replisapi.dll
I have been working with this for a while now trying to figure out why this works (on the same machine) in a winforms app but not through the web (via a windows service).
Any insight would be greatly appreciated.
Thanks...
View 3 Replies
View Related
Jun 28, 2006
I am attempting to execute xp_cmdshell with a non-sysadmin db login. I have created a Windows account and the associated proxy account in SQL Server. I have verified SQL Server is showing the proxy account credentials. I am still getting the following error. What am I missing? Guidance is very appreciated.
Microsoft OLE DB Provider for SQL Server error '80040e09'
EXECUTE permission denied on object 'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'.
View 1 Replies
View Related
Jun 8, 2006
(Posting this again since my original post has disappeared from the forum sometime during the day.)
I have about a dozen jobs that are being started at the same time (1:30am). Each time they start up, I end up with a random number of those jobs failing to run and logging the follow error:
Unable to start execution of step 1 (reason: Error authenticating proxy LSPJobUser, system error: Logon failure: unknown user name or bad password.). The step failed.
Each night it is a different collection of failed jobs (some work and some do not). If I manually run the job they ALL work EVERY time.
As anybody experienced this before? Is it possible that SQL Agent cannot handle a dozen jobs at once? (Or at a minimum cannot authenticate a dozen jobs at once.) (I do not believe it but cannot think of any other possibility.)
(For a quick fix I am going to stagger the dozen jobs to start over a ten minute period instead of starting at the same time.)
- Jason
View 4 Replies
View Related
Jul 24, 2006
Hi
i have a problem with a proxy and i don't know how to resolve this
So, i want to run a SSIS package so i follow this http://support.microsoft.com/kb/918760
However, the package fails and i have a error message which tell me that i can't get proxy's data for proxy_id = 23!
If someone has the solution please help me!!
View 1 Replies
View Related
Apr 28, 2008
Hi All,
I need to create a Proxy to run a job. So, I created a Credential, and created a proxy with that credential. The account that I am using has access as under:
1. On the database that I want to fetch data from.
2. Access in msdb - dtsoperator, dtsadmin, dtsltduser, SQLAgentOperatorRole, SQLAgentReaderRole, SQLAgentUserRole
3. The services are running on this account as well.
4. Log on as batch job, Log on as Service.
But, when I run the job, it fails with the below error.
Message
Executed as user: *** . The process could not be created for step 1 of job 0xEC1F800AD7CF2546A2DD58B2365D7D48 (reason: A required privilege is not held by the client). The step failed.
I have searched even in this forum, but could not get a satisfactory answer. Please help.
View 3 Replies
View Related
Oct 8, 2007
Good day
I'm still kinda new at this SSIS thing so pardon my ignorance.
My question has to do with the XML Data Flow source and the XML Connection. The former does not have proxy properties while the latter does.
Thus trying to connect to a RSS feed using the XML Data Flow source does not work as it has no proxy information.
Is there a work around? Or possibly some other way besides downloading the XML source file?
Thanks
View 4 Replies
View Related
May 8, 2007
Hi Experts,
Is it possible to connect to SQL Server just using the SQL server agent's proxy account and access data ( without SQL management studio or SQL / Window authentication ). The proxy account is active only for SSIS package execution subsystem.
Thanks in advance,
DBLearner.
View 1 Replies
View Related
Aug 3, 2005
I'm trying to set a proxy account for the SQL agent. The user is Local
administrator on the SQL Server when I try to set the account I get a message back that says
"The system cannot find the path specified."
I get the same error with TSQL too.
EXEC master..xp_sqlagent_proxy_account
'SET', N'MY_DOMAIN', N'Myadm', N'MyPassword'
My system :
Windows Server 2003 SP1
SQL Server 2000 SP4
I am worried it might be interfering with someing.
Any ideas what paths it could be after?
View 5 Replies
View Related
Jan 9, 2006
Hi,
I'm trying to set up an FTP process in a DTS package to download a file from an external site. There is nowhere to configure an HTTP proxy. It is getting blocked. I do have the internet options set up correctly but I guess it does not use them.
How do I get around this?
Thanks
View 2 Replies
View Related
Jan 14, 2015
I have a frustrating problem where I am using the Ola Hallengren jobs to backup to a network share. (This isn't something specific to his scripts).
For various reasons the SQL Server account can not be granted access to the share so I thought I would use a proxy account which does have access (this has been fully tested). I am using a CmdExec proxy.
The problem comes now that when I run the job it still thinks access is denied when running the xp_create_subdir command.
When I recreated this problem locally on my machine, as soon as I add the SQL Server account access to the share the backups work, so why isn't the job using the proxy account?
View 1 Replies
View Related
Jul 26, 2005
Hey, all...Some time ago, I used a tool which I believe was available from Sun. Itwas a java applet, as I recall, which sat between a SQL client and aSQL server. It allowed the client to connect to it at any port, andwould in turn connect to the server at the standard TCP port (orwhatever the server was listening on).It logged all SQL traffic between the two nodes to a flat file.Has anyone ever heard of this tool? For the life of me I can't rememberwhat it was called.Thanks!BD
View 2 Replies
View Related
Oct 30, 2006
I am trying to run SSIS packages under SQL Server Agent 2005 and I keep getting a package failed error in the event viewer.
I've heard that I need to set up a proxy account. I have found the following code and need a little explanation on what all the parts mean since I am very new to this:
Use master
CREATE CREDENTIAL [MyCredential] WITH IDENTITY = 'yourdomainmyWindowAccount', secret = 'WindowLoginPassword'
Use msdb
Sp_add_proxy @proxy_name='MyProxy', @credential_name='MyCredential'
Sp_grant_login_to_proxy @login_name=' devlogin', @proxy_name='MyProxy'
Sp_grant_proxy_to_subsystem @proxy_name='MyProxy', @subsystem_name='SSIS'
Let's say for the sake of argument my domain is called CompanyInc and I log into windows with my name Philip_Jaques and my password is badpassw0rd. Would I modify the above code this way to create my proxy?
Use master
CREATE CREDENTIAL [MyCredential] WITH IDENTITY = 'CompanyIncPhilip_Jaques', secret = 'badpassw0rd'
Use msdb
Sp_add_proxy @proxy_name='MyProxy', @credential_name='MyCredential'
Sp_grant_login_to_proxy @login_name='Philip_Jaques', @proxy_name='MyProxy'
Sp_grant_proxy_to_subsystem @proxy_name='MyProxy', @subsystem_name='SSIS'
Also, when I create this proxy account where in SQL Server 2005 can I go to view it and its properties? And assuming I get the proxy account set up correctly, how do I get my current jobs to start using it so they will successfully run?
Thanks in advance for your help and advice!
View 2 Replies
View Related
Feb 14, 2008
There is one thing that€™s confusing me in creating a proxy account.
I am trying to get an SSIS package configured as a SQL Server job and execute it from a non-sysadmin login. But when I execute it gives the error message:
Non-SysAdmins have been denied permission to run DTS Execution job steps without a proxy account. The step failed.
I know that we have to create a proxy account for this to happen and creating of proxy account prompts me to choose a credential, and that is where I do not understand the logic. From MS website I can find the following, but it is confusing to me
This proxy account must use a credential that lets SQL Server Agent run the job as the account that created the package or as an account that has the required permissions.
ref: http://support.microsoft.com/default.aspx?scid=kb;EN-US;918760
I tried reading all the related articles, but still the process of creating the credential is confusing to me, can someone throw some light on the logic of proxy/credential here?
Thanks
Satya
View 23 Replies
View Related
Sep 26, 2006
I seem to be having issues getting some of our SSIS packages to work with proxy accounts
The package is a simple pull from an access db into a sql table. The package encryption is set to EncryptAllWithPassword. The .dtsx file and the access db are both on local drives and do not have restrictive permisssions.
The package runs fine under the dev studio as well as from the command line on the server while logged in with the domainSqlJobs account. But attempting to execute the job from the Sql Agent using a using a proxy account fails, giving the following error information.
The AcquireConnection method call to the connection manager "test" failed with error code 0xC0202009.
component "OLE DB Source" (1) failed validation and returned error code 0xC020801C.
One or more component failed validation.
There were errors during task validation.
The SSIS service is running under the domainSqlServiceP account.
So here is what I have done....
I have created a login, credential, and proxy for the domainSqlJobs account. The SqlJobs proxy has been assigned principals to the desired login accounts and was assigned as the Run As account in an execute SSIS package step of a Sql Agent Job. With the proxy in place the job fails if started manually from the Managment Studio, or scheudled, no matter what account kicks off the job.
Logging in as an admin and changing the step to execute under the Sql Agent Service Account will allow the job to be run successfully, but I would rather not have to manage all of our developers jobs or elevate their rights. Using the same proxy as before, but changing the step to a cmdexec gives the same error as above. The proxy will execute SSIS packages that do not involve an access db data source
again...Logging in directly to the server with the proxy account and running the package from the command line does work...
Am I missing something?
View 1 Replies
View Related
Mar 2, 2006
We have a reverse proxy for rs 2000 -> a client requests a report, it (the proxy) then goes out to the rs box, gets the report, encrypts any return urls and feeds the modified html to the requesting client. I understand this isn't necessary anymore with rs 2005 due to the architecture. Question is, when I use the ReportExecutionService.Render method it is still returning the parameters for the report, and not the ReportSession, ControlID, Controller, etc. parameters which hides the actual return values on the href links of the report.
Documentation is plentiful for rs 2005, but examples are not. Can someone please explain to me if using the new features in rs 2005 to hide the parameter values from the users is possible via web request? Making the parameter values completely and entirely (even via sniffer) is absolutely a must (which is why we are currently encrypting return URL's).
My code:
ReportExecutionService rs = new ReportExecutionService();
rs.Credentials = System.Net.CredentialCache.DefaultCredentials;
ParameterValue[] pvValues = null;
DataSourceCredentials[] credCredentials = null;
ReportParameter[] rptparamRequiredParams = null;
ParameterValue[] pvReportParameters = null;
ExecutionHeader execHeader = null;
ExecutionInfo execInfo = null;
rptparamRequiredParams = null;
string sHistoryID = null;
{fill parameters block}
rs.SetExecutionParameters (pvReportParameters, "en-us");
try
{
string extension;
string encoding;
string mimeType;
Warning[] warnings = null;
string[] streamIDs = null;
byte[] result = rs.Render (sFormat, sDeviceSettings, out extension, out mimeType, out encoding, out warnings, out streamIDs);
string d = System.Text.Encoding.ASCII.GetString(result, 0, result.Length);
HttpContext.Current.Response.Write (d);
}
catch
{
// do stuff
}
My code is returning:
http://henneseyjm1/ReportServer$sql2005?%2fJH.RSReporting%2fBAG&cy_start_date=1%2f1%2f2006&cy_end_date=3%2f1%2f2006&region=RG20&entity_num=nothing&proc_ctr=nothing&office_num=nothing&render_format=htm&view_name=standard&group_id=0&server_name=http%3a%2f%2flocalhost%2fJHnet%2f&user_is_office=False&rs%3aParameterLanguage=&rc%3aParameters=Collapsed&rc%3aToolbar=False
Where I would like it to return:
http://localhost/Reports$sql2005/Reserved.ReportViewerWebControl.axd?ReportSession=iyvsxg45vhzwd2acii3jj4q4&ControlID=de367546-919a-4f67-be4d-cd2747166dca&Culture=1033&UICulture=9&ReportStack=1&OpType=ReportArea&Controller=ClientControllerctl161&PageNumber=1&ZoomMode=Percent&ZoomPct=100&ReloadDocMap=true&EnableFindNext=False&LinkTarget=_top
View 1 Replies
View Related
Jul 31, 2006
Hi,
because my package does not run with SQL-Server-Agent, but without problems if started by "hand", I created a new credential which contains the information needed for the package. I did this as described on: http://msdn2.microsoft.com/en-us/library/ms190703.aspx .
After that i tried to create an proxy account, but when I chose the created credential, Management Studio says "Der Proxy "[name_of_credential] ist kein gĂĽltiger Windows-Benutzer(Microsoft SQL Server, Fehler: 14529)". This means something like: "This Proxy is not a valid windows-user. Error: 14529".
Any hints how to use a credential that is not a windows-user?
Regards,
Jan Wagner
View 7 Replies
View Related
Aug 8, 2007
I can successfully execute my package via Business Studio but when I schedule it in SQL Agent I get the error message, 'could not get proxy data for proxy id = 2.' I am trying to execute the scheduled job with that proxy (call it abcd_proxy) because I have a logon id (call it abcd) with access to a specific network drive folder, which holds a required source flat file. The abcd logon is defined as a sysadmin account. I am unable to see that the abcd logon id is an added principal within the abcd_proxy, which I think is because the abcd logon principal has a sysadmin role. My proxy id = 2 definition looks to be defined the same way that my first proxy id was.
Does anyone have an idea about what the message means and how I can fix it?
View 1 Replies
View Related
Mar 8, 2006
As posted previously, thank you in advance...
--------------------------------------------
We have a reverse proxy for rs 2000 -> a client requests a report, it (the proxy) then goes out to the rs box, gets the report, encrypts any return urls and feeds the modified html to the requesting client. I understand this isn't necessary anymore with rs 2005 due to the architecture. Question is, when I use the ReportExecutionService.Render method it is still returning the parameters for the report, and not the ReportSession, ControlID, Controller, etc. parameters which hides the actual return values on the href links of the report.
Documentation is plentiful for rs 2005, but examples are not. Can someone please explain to me if using the new features in rs 2005 to hide the parameter values from the users is possible via web request? Making the parameter values completely and entirely (even via sniffer) is absolutely a must (which is why we are currently encrypting return URL's).
My code:
ReportExecutionService rs = new ReportExecutionService();
rs.Credentials = System.Net.CredentialCache.DefaultCredentials;
ParameterValue[] pvValues = null;
DataSourceCredentials[] credCredentials = null;
ReportParameter[] rptparamRequiredParams = null;
ParameterValue[] pvReportParameters = null;
ExecutionHeader execHeader = null;
ExecutionInfo execInfo = null;
rptparamRequiredParams = null;
string sHistoryID = null;
{fill parameters block}
rs.SetExecutionParameters (pvReportParameters, "en-us");
try
{
string extension;
string encoding;
string mimeType;
Warning[] warnings = null;
string[] streamIDs = null;
byte[] result = rs.Render (sFormat, sDeviceSettings, out extension, out mimeType, out encoding, out warnings, out streamIDs);
string d = System.Text.Encoding.ASCII.GetString(result, 0, result.Length);
HttpContext.Current.Response.Write (d);
}
catch
{
// do stuff
}
My code is returning:
http://henneseyjm1/ReportServer$sql2005?%2fJH.RSReporting%2fBAG&cy_start_date=1%2f1%2f2006&cy_end_date=3%2f1%2f2006&region=RG20&entity_num=nothing&proc_ctr=nothing&office_num=nothing&render_format=htm&view_name=standard&group_id=0&server_name=http%3a%2f%2flocalhost%2fJHnet%2f&user_is_office=False&rs%3aParameterLanguage=&rc%3aParameters=Collapsed&rc%3aToolbar=False
Where I would like it to return:
http://localhost/Reports$sql2005/Reserved.ReportViewerWebControl.axd?ReportSession=iyvsxg45vhzwd2acii3jj4q4&ControlID=de367546-919a-4f67-be4d-cd2747166dca&Culture=1033&UICulture=9&ReportStack=1&OpType=ReportArea&Controller=ClientControllerctl161&PageNumber=1&ZoomMode=Percent&ZoomPct=100&ReloadDocMap=true&EnableFindNext=False&LinkTarget=_top
View 1 Replies
View Related
Feb 15, 2006
Hi,
I have an SSISS package running in a job step, the job is owned and has to be run by a non-sysdamin SQL login. I have created a new credential (windows autrhentication, sysadmin priviledges) , mapped it to proxies 'SSISS' and 'Operating systems (CmdExec)' and have assigned the job step to run as that credential. Yet I'm getting the following error message:
Unable to start execution of step 1 (reason: Error authenticating proxy DomainUserName, system error: Logon failure: unknown user name or bad password.). The step failed.
Does anyone know why this is?
Thanks
View 4 Replies
View Related
Jan 2, 2008
Hello,
I'm having trouble setting up PROXY account. I follow the documentation, and Under Credentials, I can only select Operator. Is there a way to select any account under Security?
Your help is appreciated!
View 3 Replies
View Related
Apr 26, 2007
Hi experts,
Is there any potential security threat using Proxy accounts in SQL Server 2005 ? If any , Please give URLs for reference.
Thanks,
DBLearner
View 3 Replies
View Related
Aug 31, 2007
Does SQL Server 2005 support the creation of proxy tables? I have been working with Sybase ASE 12.5.
Thanks in advance.
View 1 Replies
View Related
Apr 6, 2007
I have sql server 2005 analysis services insatalled on workstation when I try to deploy a report to the reportserver I get the following error msg.
The workstation and server are on a company network.
I dont have any problem when I create reports on one of the other development servers and deploy to the same reportserver.
I have seen quite a few other threads on this none of which had a solution
===================================
A connection could not be made to the report server http://sqldev2/ReportServer. (Microsoft Report Designer)
===================================
The request failed with HTTP status 407: Proxy Authentication Required. (Microsoft.ReportingServices.Designer)
------------------------------
Program Location:
at Microsoft.SqlServer.ReportingServices2005.RSConnection.GetSecureMethods()
at Microsoft.SqlServer.ReportingServices2005.RSConnection.IsSecureMethod(String methodname)
at Microsoft.SqlServer.ReportingServices2005.RSConnection.GetItemType(String Item)
at Microsoft.ReportDesigner.Project.ReportServiceClient.GetItemType(String item)
at Microsoft.ReportDesigner.Project.ReportServiceClient.CheckAuthorized()
at Microsoft.ReportDesigner.Project.ReportClientManager.GetCredentials(String url)
at Microsoft.ReportDesigner.Project.ReportProjectDeployer.PrepareDeploy()
View 3 Replies
View Related
Jun 13, 2008
How can send mail using proxy server?
View 1 Replies
View Related
Dec 19, 2014
I have found endless articles online and tried a few different formats of the web.config file but i can not get SSRS authenticating through the proxy.
</runtime>
<system.net>
<defaultProxy enabled="true" useDefaultCredentials="true">
<proxy bypassonlocal="true" proxyaddress="http://PROXY:PORT"/>
</defaultProxy>
</system.net>
</configuration>
Is there a way to pass credentials in so we can specify which account to authenticate with?
View 0 Replies
View Related
Jan 15, 2007
I have a package which runs fine, when I execute it with my account (e.g. double-click on the .dtsx file and run it).
Now I would like to establish a job, which starts the package. I created first a credential for my Account (which is a domain administrator account also for the box, where SQL Server is running on), then I defined a proxy to this credential.
In the job definition I changed the Run as... to this Proxy (it is a SSIS Proxy) and then I started the job.
Th job does NOT abend, it runs forever! So I have to stop it manually.
In the log I can see as last entry : "operation complete". It stops at a "Execute process task" where I call the bcp utility.
Does anyone has an idea, why a package can run forever?!?!
Regards
Norbert
View 1 Replies
View Related
