sp_xp_cmdshell_proxy_account returns error code 5

Question

As part of configuring my SQL Server 2005 box to be able to use the xp_cmdshell function, I ran sp_xp_cmdshell_proxy_account to set up the credentials:

sp_xp_cmdshell_proxy_account 'Domain\DomainUser', 'password'

Unfortunately, it just returns:

Msg 15137, Level 16, State 1, Procedure sp_xp_cmdshell_proxy_account, Line 1
An error occurred during the execution of sp_xp_cmdshell_proxy_account. Possible reasons: the provided account was invalid or the '##xp_cmdshell_proxy_account##' credential could not be created. Error code: '5'.

I am assuming that this is an "Access Denied" error message.  Has anyone got any ideas on why this is happening or what I can do to narrow down what the problem is.  I can't find any logs with further information.

I have used a similar setup on another SQL Server 2005 box before and have never had a problem running the sp_xp_cmdshell_proxy_account function.  I can't see what I have done differently this time.

Further information:

The SQL Server and SQL Server Agent services are running under the Domain\DomainUser account.

I have given the Domain\DomainUser the following privileges:
Act as part of the operating system
Log on as a batch job
Log on as a service
Replace a process level token

Let me know if you need any further information.

Thanks in advance for any help.

Ben

Answer 1

Have you checked in Surface Configuration that xp_cmdshell itself is enabled?

 

/Kenneth

Answer 2

Yes, the xp_cmdshell option is enabled in the surface configuration.

As a further check, I went back to another server where I had successfully configured the xp_cmdshell function (including running sp_xp_cmdshell_proxy_account) and tried re-running sp_xp_cmdshell_proxy_account with xp_cmdshell enabled in surface configuration and then disabled.  The result was that it made no difference whether xp_cmdshell was enabled or disabled, I could still successfully run sp_xp_cmdshell_proxy_account to set up the credentials for xp_cmdshell.

Ben

Answer 3

It's not an answer to the original problem, but I have found a work-around.  The following command will create the credential that sp_xp_cmdshell_proxy_account was trying to create.

create credential ##xp_cmdshell_proxy_account## with identity = 'Domain\DomainUser', secret = 'password'

My calls to xp_cmdshell now work from a non-administrator account.

This makes me wonder what sp_xp_cmdshell_proxy_account was trying to do that caused the error.

Ben

Answer 4

Hey did you ever get a response to why sp_xp_cmdshell_proxy_account didn't work?

Answer 5

I tried it using create credential and was able to create a proxy account but the users were not able to use xpcmdshell.
what could be the problem. do i need to change anything at the system level.

Answer 6

I ran into the same problem on my system and it was related to UAC.   If you launch SQL Enterprise Manager as an Administrator the command runs.  If you don't run as administrator internally the API call to LsaOpenPolicy fails.

Vista SP1

Msg 15137

, Level 16, State 1, Procedure sp_xp_cmdshell_proxy_account, Line 1
An error occurred during the execution of sp_xp_cmdshell_proxy_account. Possible reasons: the provided account was invalid or the '##xp_cmdshell_proxy_account##' credential could not be created. Error code: '5'.

 

Vista SP2

Msg 15137, Level 16, State 1, Procedure sp_xp_cmdshell_proxy_account, Line 1
An error occurred during the execution of sp_xp_cmdshell_proxy_account. Possible reasons: the provided account was invalid or the '##xp_cmdshell_proxy_account##' credential could not be created. Error code: '0'.

 

 

---

Robert A. Dorr (SQL Server Senior Escalation Engineer)

Answer 7

hi,

I am also getting the same error.
did you get any workaround for this issue?

regards
Rahul Bobal

Answer 8

Use Windows Authentication to issue the command!!

Answer 9

This workaround from Ben12 worked for me on a SQL2008R2 new install with the same symptoms as the original problem.

---

Brian Searle

Answer 10

I was experiencing the same problem.  I executed the commands using a windows authentication user instead of an SQL user.  It worked fine under the windows user.

Answer 11

Hi,

Launch SSMS "run as administrator" and then the Command(s) completed successfully.

Answer 12

Thanks! That was the problem for me.

UAC - a common cause for errors. Should've disabled it from the start.