Potential Impact of Removing Domain Admin Privileges from a SharePoint Service Account

Yes, you can remove spsqladmin from Domain Admins, and this is generally recommended under the principle of least privilege. However, you should verify its actual permissions before making the change.

Potential impact

SQL Servers: SQL Server services generally do not require Domain Admin privileges. Local Administrator membership may still be excessive.

SharePoint servers: SharePoint services require specific permissions, including database permissions and service-specific privileges. Local Administrator membership alone may not be sufficient.

Search Server: Verify service account permissions and access to required databases and resources.

Office Online Server: Verify whether the account is actually used by any services or integrations.

Recommended approach

Identify all Windows services, scheduled tasks, and application pools running under spsqladmin.

Review SharePoint service account requirements for your installed SharePoint version.

Verify SQL Server permissions, database ownership, and required service permissions.

Check Group Policy and any permissions inherited through Domain Admins.

Remove Domain Admin membership in a test environment first.

Monitor SharePoint, SQL Server, and Windows event logs after the change.

Important recommendation

Do not remove Domain Admin privileges and assume that local Administrators membership will cover everything. Domain Admin membership may provide additional permissions through AD groups, ACLs, or policies.

My advice: Removing Domain Admin membership is the right security objective, but migrate to appropriately scoped service accounts and permissions rather than simply relying on local Administrator rights.

Also, consider using Group Managed Service Accounts (gMSA) where supported by your SharePoint and SQL Server versions.