User with Farm Administrator rights, but NOT in Farm Administrators Group

Question

I have an account that we recently discovered has Farm Administrator rights and was used to access Central Admin and cause some harm.  When I use the "Check Permissions" on the Central Admin site, it says that account has Full Control via
the Farm Administrators Group.  However, that account is not in the Farm Adminstrators group.
There is an entry in the Farm Administrators group for "BUILTIN\Administrators" and this account is in the Local Admin group on this server.  However, there are other accounts in the Local Admin group too, and when I "Check Permissions"
for them, it returns 'None'. 
I am confused as to how this one account has Farm Administration level access, while others in Local Admin do not, and how can I remove this accounts Farm Administration rights if it is NOT in the Farm Adminstrators Group?
What are the potential problems/issues if I remove the "BUILTIN\Administrators" entry from the Farm Adminstrators Group?
Thanks in advance for any feedback/help.

Answer 1

If you have BUILTIN\Administrators as part of the Farm Admins, any user that is a Local Administrator will have Farm Admin rights. SharePoint doesn't enumerate groups when checking permissions, so the behavior you're seeing is correct. If you do not want
Local Admins to have Farm Admin rights, remove BUILTIN\Administrators from the Farm Admins group in SharePoint.
There should not be any issue with removing the group from Farm Admins, only that users will need both rights to fully manage SharePoint.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.