Because BUILTIN\Administrators appears in the list of Farm administrators and the local Administrator group contains the Domain Administrators group, any domain admins get access to my SharePoint sites.
My first question: does the above scenario generally apply to all default SharePoint installations? Or is just something that is specific to my environment due to network policies or something?
My second question: if this is something that generally applies to all default SharePoint installations, what would be the recommended approach for revoking access for domain administrators? a) Remove Domain Administrators from local Administrators group, b) remove BUILTIN\Administrators from list of Farm Administrators, or c) some other approach I haven't thought of yet?