Sql-server – Which SQL Server/Windows logins require the sysadmin role

Individual accounts are going to be much harder to administer. They give you more granular control over access, but you can not keep out your Active Directory administrators. Anyone who is granted local administrator rights on your server can gain sysadmin access to the instance. And, as a very good DBA told me once, if you can't trust your domain admins you've got bigger problems on your hands.

By abstracting your access to AD groups, you gain two benefits:

1. Easier to manage access groups and rights based on roles, combined with stratified access control for other assets using those AD groups.
2. Provide more consistent auditing, as you will only need to show access by AD group and then who is contained within that group.

The following logins will be created on installation. They are containers for the accounts that the SQL Server Database Engine & Agent run under.

 [NT SERVICE\MSSQLSERVER]

 [NT SERVICE\SQLSERVERAGENT]

The other accounts are groups that have been manually added into your SQL instance.

BUILTIN\Administrators was installed by default in SQL Server 2005 but not in SQL Server 2008 R2.

I'd look at the permissions on the existing server to see what accounts are using these groups and then determine if they are needed.