On my SP 2007 environment I been trying to have my administrators not use the farm adm account for their administration and use their own credentials. So we started by creating a security group with local admin rights on the server and determined that some of the functionality also required dbo_owner membership towards the content and configuration databases and database server level security (dbcreator, securtityadmin) roles to run stsadm and psconfig operations.
My questions now are:
1. Considering I have more than one web application and more than one site collection, can I manage my administrators via a security group or will I still be required to log in to each site collection and set them as site collection administrators? Previously I've had to log into each and set each as a site collection administrator which only allows to set at a user level (not with a security group).
2. Can a security group be used to manage the maintenance required by Farm Admin to the point where I can avoid any user logging in as a farm admin and set farm account as service only (prevemto)