It's a well known fact that anyone with "SA" privs can turn on xp_CmdShell and use it and that includes any would-be attackers that can gain access to SQL Server as a login that has "SA" privs. There are some very good best practices to help prevent an attacker from "getting in as 'SA'" including disabling the "SA" login but that doesn't prevent an attacker from getting in as a DBA who might have "SA" privs by using any one of a dozen automated password cracking methods.
In my study on the subject, I came across an article at the following URL http://msdn.microsoft.com/en-us/library/ms175046.aspx where I found the following quote:
Because malicious users sometimes attempt to elevate their privileges by using xp_cmdshell, xp_cmdshell is disabled by default. Use sp_configure or Policy Based Management to enable it.
That's actually a pretty useless recommendation so far as I'm concerned. Since malicious users can't actually use xp_CmdShell unless they have "SA" (or Control Server) privs, they'll try to break in as someone with "SA" privs. If they succeed, there is NOTHING that I'm aware of in SQL Server that will prevent them from turning xp_CmdShell on and using it for whatever they need to use it for. Of course, you can limit the damage by throttling back the privs of the logins for the SQL Server Service and the SQL Agent but they can still mess with your server a lot by using xp_CmdShell.
So, the best thing to do would be to make it so that even "SA" prived logins couldn't enable xp_CmdShell. The useful part of the quote above is that you can use "Policy Based Management to enable it", which infers that you can use PBM to disable it, as well.
With that thought in mind, is there a way to use Windows or anything within SQL Server to make it so that even people with "SA" privs can't enable xp_CmdShell? My initial thought is "NO" but I'm definitely NOT a Windows security guru by any means and I'm not even sure what I should be looking for to answer this question.
And, to be honest, I don't care which way it comes out... I just need a definitive answer one way or another.
Thanks for the help, folks. I really appreciate it.