Disallow access to SharePoint sites by default for Domain Administrators

Question

Because BUILTIN\Administrators appears in the list of Farm administrators and the local Administrator group contains the Domain Administrators group, any domain admins get access to my SharePoint sites.

My first question: does the above scenario generally apply to all default SharePoint installations? Or is just something that is specific to my environment due to network policies or something?

My second question: if this is something that generally applies to all default SharePoint installations, what would be the recommended approach for revoking access for domain administrators? a) Remove Domain Administrators from local Administrators group, b) remove BUILTIN\Administrators from list of Farm Administrators, or c) some other approach I haven't thought of yet?

Answer 1

Well, in our environment, the domain admins only have access to central admin out of the box. Unless you add them as having full control to your web application policy, they shouldn't have access to your web application.

I think the second question depends on your org structure. At my work our domain admins take care of everything from hardware through the OS. But any software on top of the OS is our responsibility. So it would make sense to me to leave them in the local admin group but remove builtin\administrators from the list of farm admins.

Answer 2

Agree with Steve.

Theres a good writeup on security hardening and planning administrative account setup on Technet here.