I know-know I can search and read but anyway I would need to ask in order to escape possible typos, personal misunderstandings and to better remember.

I develop on a machine with installed Sharepoint 2010 Sever where I have local groups:

  • Administrators
    Description: Administrators have complete and unrestricted access to the computer/domain enter image description here
  • WSS_Admin_WPG
    Description: Members of this group have write access to system resources used by Microsoft SharePoint Foundation
    enter image description here

**Does the description of "Administrators" ("computer/domain") imply all privileges of "WSS_Admin_WPG" ?

Does the description of **WSS_Admin_WPG (in part of "system resources used by Microsoft SharePoint Foundation") imply Sharepoint Server?**

The WSS_Admin_WPG group has entries of:

  • "BUILTIN\Administrators (S-1-5-32-544)" group
  • and some user domain accounts

Is "BUILTIN\Administrators (S-1-5-32-544)" group the same (alias to?) as "BUILTIN\Administrators" entry I observe among Sharepoint Farm Administrators (through "Central Administration")?

enter image description here

Is the entries of domain accounts excessive (or necessary)

  • in "WSS_Admin_WPG" if these accounts make part of "Administrators" group?
  • in "Farm Administrators" if these accounts are part of "BUILTIN\Administrators (S-1-5-32-544)" group?

What are relationship (difference) between "BUILTIN\Administrators" and "Administrators"?

1 Answer 1


Here are the answers to your questions.

Does the description of Administrators (computer/domain) imply all privileges of WSS_Admin_WPG?

No Administrators Group have full priviledges in the system and WSS_Admin_WPG have very specific privileges in the system.

These special priviledges includes rights to registry entries

"HKEY_CLASSES_ROOT\APPID\{58F1D482-A132-4297-9B8A-F8E4E600CDF6} " "HKEY_CLASSES_ROOT\APPID\{6002D29F-1366-4523-88C1-56D59BFEF8CB} " "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\14.0\Registration\{90120000-110D-0000-0000-0000000FF1CE} " "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server " "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0 " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office Server\14.0\LoadBalancerSettings " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office Server\14.0\LauncherSettings " "HKEY_LOCAL_MACHINE\Software\Microsoft\Office Server\14.0\Search " "HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\14.0\Search " "HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\14.0\Secure " "HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\14.0\WSS "

rights to file systems

"%AllUsersProfile%\Application Data\Microsoft\Sharepoint " "C:\Inetpub\wwwroot\wss " "%ProgramFiles%\Microsoft Office Servers\14.0 " "%ProgramFiles%\Microsoft Office Servers\14.0\WebServices " "%ProgramFiles%\Microsoft Office Servers\14.0\Data " "%ProgramFiles%\Microsoft Office Servers\14.0\Logs " "%ProgramFiles%\Microsoft Office Servers\14.0\Data\Office Server " "%windir%\System32\drivers\etc\HOSTS " "%windir%\Tasks " "%COMMONPROGRAMFILES%Microsoft Shared\Web Server Extensions\14 " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\ADMISAPI " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\CONFIG " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\LOGS " "%COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\14\Data " "%windir%\temp " "%windir%\System32\logfiles\SharePoint " "%systemdrive\program files\Microsoft Office Servers\14 folder on Index servers "

Does the description of WSS_Admin_WPG (in part of "system resources used by Microsoft SharePoint Foundation") imply Sharepoint Server?*
WSS_Admin_WPG group is used by Application Pool Accounts for Central Administration and Timer Services.

What are relationship (difference) between "BUILTIN\Administrators" and "Administrators"?
The BUILTIN\Administrators group is a member of the Farm Administrators group. They constitute of all local administrators present in the physical server. You can remove this group if you already have added separate service account preferrably (Domain user based Service account) and Domain user based "farm administrators". Else, you will land up in access denied error on accessing Central Admin site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.