Least Privilege Service Accounts - confusion

Question

I'm confused about least privilege accounts during sharepoint 2010 farm setup. I found an article describing this approach here, where author says:

Specifically, SP_Farm must be in the local Administrators group of every server in the farm. You must manually add SP_Farm to the local Administrators group on a server before installing SharePoint on that server!

Doing as author suggests, leads to warning in sharepoint's central administration, saying that application pool identities or service accounts belong to computer administrators group. So basically what author is suggesting leads to an security issue. As far as I know, SP_Farm account should be in computer administrator group during Profile Synchronization provisioning, and should be removed from that group after being successfully provisioned. Am I right?

Also, as far I know, SP_Farm shouldn't be allowed to logon locally by server's local security policy. It shouldbe allowed only for provisioning profile synchronization, and then local logon should be disabled after provisioning profile synchronization.

I'd like to know if I'm correct. If I'm wrong - correct me, please.

Answer 1

That is right, the farm account should only be a local administrator when provisioning the User Profile Service Synchronization service. I gather the person in the quotes is talking about when actually installing the SharePoint software on the machine, which requires Administrator permissions, but can be done with any account with administrative privileges.