I realized that inside the SharePoint On-Premises 2013 Central Administration, the "BUILTIN\Administrators" is being added inside the "Farm Administrators" group + 2 service accounts as follow:-

enter image description here

now I do understand that the 2 service accounts should be Farm Admins, but do we need the "BUILTIN\Administrators"? as in our case the "BUILTIN\Administrators" contain some domain admin users which should not be accessing the SP CA?? in our case the "BUILTIN\Administrators" group contain these users/groups:-

enter image description here

and the SharePoint services are either using the "Local Account" OR a service account as follow:-

enter image description here

second question. now if I access any site collection using the service accounts, I will get full control on them. but if I access any site collection using a user who is defined insdie "BUILTIN\Administrators", then this user will not have any permsion on the site collection by default. so what is the scenario behind this behavioure. can I say that by default Farm Admin users will not have any permsion of the site collections, unless they are defined as managed accounts ??

third question. now let say for now , I remove the "BUILTIN\Administrators" from the "Farm Admin" group, and later on i realized that this caused issues, then will the solution for this, is to simply add the "BUILTIN\Administrators" back to the "Farm Admins" group??


Removing BUILTIN\Administrators is perfectly acceptable. Farm Admins do not have access to sites by default. What you're probably seeing is permissions granted on the Web Application User Policy are allowing the Farm Admins to access all Site Collections.

And yes, you can simply add the group back to the Farm Admins group.

  • thanks for your reply, so now can I say, that even I have some services such as "SP tracing service" & "SP VSS writer" & "SP administration" run under the "Local System" account, then I do not have to add this "Local System" account inside the Farm Admin SP group?
    – Peter A
    Jan 26 '18 at 15:56
  • 1
    That is correct. And those services should not be changed from Local System. Jan 26 '18 at 15:56
  • so local system should not be part of the "Farm Admin" group ?
    – Peter A
    Jan 26 '18 at 15:58
  • 1
    No, it shouldn't. Jan 26 '18 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.