Search code examples
sqlsql-server-2005t-sqlcommand-linewindows-server-2003

Access denied when trying to move files with xp_cmdshell

Im trying to use some T-SQL to move some files from one directory to another. Im using xp_cmdshell to call the move command Just like this:

create table #output(line varchar(2000) null)
insert into #output exec master..xp_cmdshell 'move /y "D:\files\*.txt" "D:\oldfiles"'

But the files inst move and the #output table contains this output from the move command

Access is denied.
Access is denied.
Access is denied.
Access is denied.
Access is denied.
Access is denied.
        0 file(s) moved.
NULL

The sql server proxy account is mapped to the local administrator If i open a command prompt at enter the move command

move /y "D:\files\*.txt" "D:\oldfiles"

The files are moved perfectly

Its all happening on a sql2005 running on a w2k3 server.

Im logged into the server as local administrator

Solution

  • Can you run a "who am I?" command, like this:

    exec master..xp_cmdshell 'whoami'

    and tell what this returns?

    EDIT:

    • By the OP's comment, the commands are run as NETWORK SERVICE. Allowing NETWORK SERVICE on the directory in question solved the problem.

    • "Modify" permissions are sufficient for file changes.

    • If the file is on a network share instead of a local drive, make sure that the sufficient permissions are set on the share itself as well. File permissions are checked after share permissions, so if the file allows "Modify", but the share only allows "Read", the overall permissions will still be "Read".