Enable the T-SQL xp_cmdshell command

Symptom: SQL Server refuses to run xp_cmdshell with

SQL Server blocked access to procedure ‘sys.xp_cmdshell’ of component ‘xp_cmdshell’ because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of ‘xp_cmdshell’ by using sp_configure.

xp_cmdshell ships disabled by default (since SQL Server 2005) precisely because it lets the database engine spawn OS commands under the service account — a favourite escalation path. When you genuinely need it (legacy jobs, bcp exports, DirSync-style maintenance), enable it like this:

sp_configure 'show advanced options', 1;
GO
RECONFIGURE;
GO
sp_configure 'xp_cmdshell', 1;
GO
RECONFIGURE;

xp_cmdshell is an advanced option, so show advanced options must be 1 before sp_configure will even accept it — the classic mistake is skipping the first pair and getting “The configuration option ‘xp_cmdshell’ does not exist”.

Before you enable it

• Least privilege: only members of sysadmin can use it by default. Don’t grant the EXECUTE permission on it to non-admins; if an app needs OS access, prefer a brokered approach (a service, an Agent job, CLR with a narrow surface) over opening this up.
• It runs as the SQL Server service account — whatever the shell touches, the engine can touch. Keep that account’s permissions tight.
• Command injection is trivial here. Never concatenate user input into the command string.
• Turn it off when you’re done: the same script with 0 disables it again — the right end state for a production server that only needed it once.
• Azure SQL Database doesn’t have it at all. Plan on external execution (Azure Functions, ADF, or a client job) instead.

References (verified live): xp_cmdshell (Transact-SQL) and the xp_cmdshell server configuration option on Microsoft Learn.