The problem is that xp_fileexist executes under the security context of the sql user if the user does not have sysadmin role, and the sql user will not have permissions...