MSSQLTips

http://www.mssqltips.com/tip.asp?tip=1017

The problem not mentined in the article (I know it's about 4 years old now) is that removing that group makes the SQL Server Agent service fail. I guess you have to create an account with a non-expiring password in order for that to work. Fix one problem, though and cause another. Sometimes I have to ask do you want it secure or do you want it to work?

Bedwar2,

Thank you for the feedback.  I think the situation you mentioned can be alleviated by granting the “DBA” Windows domain group SQL Server sysadmin rights before making any changes to the BUILTIN\Administrators Group rights in SQL Server.   In addition, setup the SQL Server services to execute with a Windows domain account which has SQL Server sysadmin rights before making any changes to the BUILTIN\Administrators Group rights in SQL Server.   As a last preventive measure, be sure you know the sa password and validate you are able to access the SQL Server before making any changes to the BUILTIN\Administrators Group rights in SQL Server .  Hopefully this will prevent any sort of permissions issues.

Thank you,
The MSSQLTips Team