SharePoint Farm Admin Account in local administrators group

Question

I installed and configured SharePoint using SPSetup domain account.

I gave SPFarmAdmin as the database access/ farm admin while configuring SharePoint.

Now as per recommendation in some blogs I did not add SPFarmAdmin to the local administrators group

When I logged in Central admin, it disabled the ribbon from where I can create New web application and some other pages like Configure SErvice accounts etc.

I have the site added as trusted and in intranet zone as suggested in some forums. Yet it did not work. As soon as I added the SPFarmAdmin account to local administrators group, the pagaes and ribbons were enabled.

So does it mean that SPFarmAdmin have to be in local administrators group ? or is there some other permission that I can give there and have central admin work.

Answer 1

So here is what I understood and posting it here for benifit of others...

Manage Service Accounts and New Web Application creation cannot be accessed if your account is not Local Admin on the SharePoint server even you are Farm Admin. SharePoint takes this information from IIS and if your account is not local admin then you cannot access the IIS, hence the error