It is always considered as a best practice to disable XP_CMDSHELL when not in use. A database administrator can disable XP_CMDSHELL using SP_CONFIGURE system stored procedure. To disable XP_CMDSHELL execute the below mentioned script.

Use Master
 GO

 EXEC master.dbo.sp_configure 'xp_cmdshell', 0
 RECONFIGURE WITH OVERRIDE
 GO

 EXEC master.dbo.sp_configure 'show advanced options', 0
 RECONFIGURE WITH OVERRIDE
 GO