What are the relationship between administrators groups of domain, dev computer and of Sharepoint services?

Question

I know-know I can search and read but anyway I would need to ask in order to escape possible typos, personal misunderstandings and to better remember.

I develop on a machine with installed Sharepoint 2010 Sever where I have local groups:

• Administrators
  Description: Administrators have complete and unrestricted access to the computer/domain
• WSS_Admin_WPG
  Description: Members of this group have write access to system resources used by Microsoft SharePoint Foundation
  

**Does the description of "Administrators" ("computer/domain") imply all privileges of "WSS_Admin_WPG" ?

Does the description of **WSS_Admin_WPG (in part of "system resources used by Microsoft SharePoint Foundation") imply Sharepoint Server?**

The WSS_Admin_WPG group has entries of:

• "BUILTIN\Administrators (S-1-5-32-544)" group
• and some user domain accounts

Is "BUILTIN\Administrators (S-1-5-32-544)" group the same (alias to?) as "BUILTIN\Administrators" entry I observe among Sharepoint Farm Administrators (through "Central Administration")?

Is the entries of domain accounts excessive (or necessary)

• in "WSS_Admin_WPG" if these accounts make part of "Administrators" group?
• in "Farm Administrators" if these accounts are part of "BUILTIN\Administrators (S-1-5-32-544)" group?

What are relationship (difference) between "BUILTIN\Administrators" and "Administrators"?

Answer 1

Here are the answers to your questions.

Does the description of Administrators (computer/domain) imply all privileges of WSS_Admin_WPG?

No Administrators Group have full priviledges in the system and WSS_Admin_WPG have very specific privileges in the system.

These special priviledges includes rights to registry entries

"HKEY_CLASSES_ROOT\APPID\{58F1D482-A132-4297-9B8A-F8E4E600CDF6} " "HKEY_CLASSES_ROOT\APPID\{6002D29F-1366-4523-88C1-56D59BFEF8CB} " "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\14.0\Registration\{90120000-110D-0000-0000-0000000FF1CE} " "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server " "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0 " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office Server\14.0\LoadBalancerSettings " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office Server\14.0\LauncherSettings " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office Server\14.0\Search " "HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\14.0\Search " "HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\14.0\Secure " "HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\14.0\WSS "

rights to file systems

"%AllUsersProfile%\Application Data\Microsoft\Sharepoint " "C:\Inetpub\wwwroot\wss " "%ProgramFiles%\Microsoft Office Servers\14.0 " "%ProgramFiles%\Microsoft Office Servers\14.0\WebServices " "%ProgramFiles%\Microsoft Office Servers\14.0\Data " "%ProgramFiles%\Microsoft Office Servers\14.0\Logs " "%ProgramFiles%\Microsoft Office Servers\14.0\Data\Office Server " "%windir%\System32\drivers\etc\HOSTS " "%windir%\Tasks " "%COMMONPROGRAMFILES%Microsoft Shared\Web Server Extensions\14 " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\ADMISAPI " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\CONFIG " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\LOGS " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\Data " "%windir%\temp " "%windir%\System32\logfiles\SharePoint " "%systemdrive\program files\Microsoft Office Servers\14 folder on Index servers "

Does the description of WSS_Admin_WPG (in part of "system resources used by Microsoft SharePoint Foundation") imply Sharepoint Server?*
WSS_Admin_WPG group is used by Application Pool Accounts for Central Administration and Timer Services.

What are relationship (difference) between "BUILTIN\Administrators" and "Administrators"?
The BUILTIN\Administrators group is a member of the Farm Administrators group. They constitute of all local administrators present in the physical server. You can remove this group if you already have added separate service account preferrably (Domain user based Service account) and Domain user based "farm administrators". Else, you will land up in access denied error on accessing Central Admin site.