KB202446 - INF: How to Remove the Default Mapping of Windows NT Administrators to SQL Server SA

MORE INFORMATION

To prevent local Administrators from receiving trusted connections, perform the following steps:

Create a group that is to be given SA login rights. Add the account(s) used by SQL Server and SQL Executive to this group, along with any user accounts that require SA access.
Ensure that the account(s) used by SQL Server and SQL Executive are also members of the local Windows NT Administrators group. It is necessary that the SQL Server and SQL Executive accounts have Windows NT Administrator and SA level privileges. Failure to ensure that these accounts have the proper permissions may prevent SQL Server from functioning properly.
Using SQL Security Manager, grant SA login permissions to the appropriate group and revoke SA login permissions for the local Administrators group.
As with any change in group or permission status, it may be necessary to have the affected accounts log out and log back in to have the changes take effect. In the case of SQL Server, this would require cycling the service.