What’s the issue?
SQL Server provides several fixed server roles beyond sysadmin that grant specific subsets of instance-level authority. These roles exist to support delegated administration, letting a team assign specific responsibilities without granting full instance control.
This check covers membership in serveradmin, dbcreator, and setupadmin. The securityadmin role and the sysadmin role are evaluated by separate checks, since each carries its own distinct escalation path and warrants individual attention.
Membership in each of these three roles is detected by querying sys.server_role_members joined to sys.server_principals.
Why is this a problem?
serveradmin members can change any instance-level configuration option and shut down the SQL Server service. Configuration control alone is a broad authority, since it includes settings that govern surface area and security behavior, and the ability to stop the service means a member can take the entire instance offline. A member who can restart the service in single-user mode can also connect and acquire sysadmin.
dbcreator members can create, alter, drop, and restore any database. The restore capability is the significant one, because a member can restore a database from an arbitrary backup file and become its owner, then use db_owner authority within it. Combined with a privileged database owner or with TRUSTWORTHY enabled, this becomes a path to instance-wide control.
setupadmin members can add and remove linked servers and execute certain system stored procedures. Linked server creation is the concern here, since a member can define a linked server whose remote credential is a privileged account on another instance, granting themselves elevated access to that system without any approval from its administrators.
What should you do about this?
Find membership in serveradmin, dbcreator, and setupadmin by querying sys.server_role_members joined to sys.server_principals, and review each member against a current, documented job role. Treat these memberships with the same scrutiny you apply to sysadmin.
Remove memberships that are not required with ALTER SERVER ROLE [RoleName] DROP MEMBER [LoginName];, and replace them with narrower grants scoped to the specific operations the principal actually needs. Most delegated tasks can be handled with targeted permissions rather than a fixed server role.
Document the approved members of each role, the business justification, and the date of the most recent review.