“The server farm account should not be used for other services”, but isn't in any group

Question

I have 2 accounts setup form my SharePoint Server (SPAdmin and SPServices). SPAdmin is in the local server's administration group and is the Farm Admin. I am running SharePoint 2013 Enterprise.

In the /_admin/FarmCredentialManagement.aspx page I have the following :

SPAdmin user is in the the following components:

• Farm Account

SPServices user is in the following components:

• Windows Service - Distributed Cache
• Windows Service - Microsoft SharePoint Foundation Sandboxed Code Service
• Windows Service - Search Host Controller Service
• Windows Service - SharePoint Server Search
• Windows Service - User Profile Synchronization Service
• Web Application Pool - SharePoint - 80
• Security Token Service Application (Security Token Service Application)
• Service Application Pool - SharePoint Web Services Default
• Service Application Pool - SharePoint Web Services System

Local System user is in the the following components:

• Windows Service - Claims to Windows Token Service
• Windows Service - Document Conversions Launcher Service
• Windows Service - Document Conversions Load Balancer Service
• Service Application Pool - SharePoint Web Services Default
• Service Application Pool - SharePoint Web Services System

I am getting the following error in the Health Analyzer.

Accounts used by application pools or service identities are in the local machine Administrators group.

Severity
2 - Warning
Category
Security

Explanation
Using highly-privileged accounts as application pool or as service identities poses a security risk to the farm, and could allow malicious code to execute.  
The following services are currently running as accounts in the machine

Administrators group: 

SharePoint Central Administration v4 (Application Pool)
SPTimerV4(Windows Service)

Answer 1

The Admin account shouldn't be part of the local admins group on the server in the long-term. For SharePoint 2013 membership of the local admins group is required for the configuration of the User Profile Service Application synchronisation service, but once that is complete, you can remove the account from the local admins group.

See http://www.toddklindt.com and https://technet.microsoft.com for information on suggested service accounts and the permissions that they require.