Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Because BUILTIN\Administrators appears in the list of Farm administrators and the local Administrator group contains the Domain Administrators group, any domain admins get access to my SharePoint sites.

My first question: does the above scenario generally apply to all default SharePoint installations? Or is just something that is specific to my environment due to network policies or something?

My second question: if this is something that generally applies to all default SharePoint installations, what would be the recommended approach for revoking access for domain administrators? a) Remove Domain Administrators from local Administrators group, b) remove BUILTIN\Administrators from list of Farm Administrators, or c) some other approach I haven't thought of yet?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Well, in our environment, the domain admins only have access to central admin out of the box. Unless you add them as having full control to your web application policy, they shouldn't have access to your web application.

I think the second question depends on your org structure. At my work our domain admins take care of everything from hardware through the OS. But any software on top of the OS is our responsibility. So it would make sense to me to leave them in the local admin group but remove builtin\administrators from the list of farm admins.

share|improve this answer
    
thanks, accepted as answer :) –  Jaap Vossers Dec 17 '09 at 10:10

Agree with Steve.

Theres a good writeup on security hardening and planning administrative account setup on Technet here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.