SharePoint 2007: Farm administrator process

Question

I have run into an interesting issue. We added a new user as a Farm Admin on the SharePoint 2007 env. The next day the user's account was disabled by IT as it was flagged by monitoring as the SPS service account was used to add this user's account to the local Administrators group on the SharePoint servers.

Does SharePoint add user accounts to the local administrators group when they are added as a Farm admin?

Answer 1

local Administrators group is a member of the farm administrators group.

Simple answer is no!

Members of the Administrators group on the local server computer are automatically added to the Farm Administrators group and can perform all farm administrator actions

and

The farm administrator has permissions to and responsibility for all servers in the server farm. The Farm Administrators SharePoint group replaces the SharePoint Administrators group that was used in Windows SharePoint Services version 2.0. Members of the Farm Administrators group do not need to be added to the Administrators group for each server. Farm administrators are members of the WSS_WPG and WSS_RESTRICTED_WPG groups on the computers where Central Administration is hosted and have the Full Control permission level on all servers in the environment. By default, members of the Administrators group are members of the Farm Administrators SharePoint group.

Members of the Farm Administrators group have no administrative access to individual sites or their content by default

http://technet.microsoft.com/en-us/library/cc288186(v=office.12).aspx

To add a user or group to the Farm Administrators group and the Site Collection Administrators group in Windows SharePoint Services 3.0

1. On the server that hosts Windows SharePoint Services 3.0, click Start, point to Administrative Tools, and then click SharePoint 3.0 Central Administration.

2. In Central Administration, click Operations.

3. In Operations, under Security Configuration, click Update farm administrator's group.

4. In People and Groups: Farm Administrators, click New, and then click Add Users.

5. In Add Users, type the account name for the user or group to whom you want to grant farm administrator permissions. In Give Permission, make sure that the Farm Administrators check box is selected, and then click OK.

6. In People and Groups: Farm Administrators, in Site Actions, click Site Settings.

7. In Site Settings, in Users and Permissions, click Site collection administrators.

8. In Site Collection Administrators, type the account name for the user or group to whom you want to grant administrator permissions for the site collection, and then click OK.

http://msdn.microsoft.com/en-us/library/ms253179(v=vs.90).aspx

What i take from that is its the opposite way around :)

Hope it helps :)