We have recently installed Sharepoint 2016. Our installation has followed Microsoft's recommendations (https://technet.microsoft.com/nl-nl/library/ee662513(v=office.16).aspx ) regarding Service Account least privilege and as such the farm service account and install service account are granted the DBCreator and SecurityAdmin roles on SQL server.
Once the farm installation and configuration process has been completed we have noticed that the farm service account appears to have been granted the 'Control Server' permission level in SQL server.
This must have been granted as part of the installation or PSconfig process at some point. Understandably our SQL DBA's are slightly concerned that this is an elevated privilege that is close to full Sysadmin access in SQL and presents some security concerns.
We have seen that this permission level has been granted to the farm service account on each of our Sharepoint server farms (Dev, Test, Prod) so this does not seem to be a one-off anomaly.
There does not appear to be any reference to this permission level being granted to the farm service account in any of Microsoft's documentation.
The question is, should we try and remove the permission from the service account? Would it be likely to cause any issues for us? Has anybody else noticed this on their Sharepoint farms?