Hi

I have several Windows Server 2012R2 with ASA Version: 16.0.0.2283 installed but I have one in particular where xp_cmdshell doesn't work.

I have created a Service wich run with the Local system account and IT DOESN'T WORK, but if I create the Service wich run with Other Account using the user administrator (Windows Server user), IT WORKS FINE. This is a problem, because each time my customer change the administrator password, I have to change the password for the ASA service

Is there any security consideration ?

/////////////////////////////////////////////////////////////////////////

With a Service wich run with the Local system account :

/////////////////////////////////////////////////////////////////////////

CREATE FUNCTION "dba"."f_getmac"() RETURNS LONG VARCHAR
NOT DETERMINISTIC
BEGIN

DECLARE ls_ret LONG VARCHAR;  
DECLARE ls_command VARCHAR(255);  
DECLARE ls_file VARCHAR(255);  
DECLARE ls_data LONG VARCHAR;  
DECLARE ls_mac CHAR(17);  
DECLARE li_pos NUMERIC(5);   
DECLARE li_ret NUMERIC(5);

SET ls_file = 'c:\\test\\macinfo.txt' ;

SET ls_command = 'getmac /NH /FO CSV > ' + ls_file ;

SET li_ret = xp_cmdshell(ls_command,'no_output') ;

IF li_ret = 2 THEN  
    SET ls_ret = 'Error executing: ' + ls_command ;  
    RETURN ls_ret ; 
END IF ;

WAITFOR DELAY '00:00:02' ;

SET ls_data = xp_read_file(ls_file) ;

IF ( ls_data is null ) OR ( length(trim(ls_data)) = 0 ) THEN  
    SET ls_mac = 'NO DATA ON FILE' ;   
ELSE
    SET li_pos = LOCATE(upper(ls_data),'\DEVICE\') ;  
    IF li_pos > 0 THEN  
        SET ls_mac = SUBSTR(ls_data,li_pos - 20,17) ;   
        ELSE  
        SET ls_mac = '\DEVICE\ NO FOUND' ;   
    END IF ;                  
END IF ;

SET ls_ret = ls_mac ;

RETURN ls_ret ;

END

/////////////////////////////////////////////////////////////////////////

In the windows session as administrator (Windows Server user) at Sybase Central I log into the Database as dba and I execute on Interactive SQL:

SELECT "dba"."f_getmac"() ;

the result is:

NO DATA ON FILE

the file c:\test\macinfo.txt is NOT created.

/////////////////////////////////////////////////////////////////////////

In the same windows session as administrator (Windows Server user) if I execute at the command promt: getmac /NH /FO CSV > c:\test\macinfo.txt

the file c:\test\macinfo.txt is created and the contents is OK:

"DC-53-60-17-34-F5","\Device\Tcpip_{BF4E5CFB-81B6-431F-90B6-1B520099BBD1}"

/////////////////////////////////////////////////////////////////////////