In sql2k5, windows local admin group on sql server machine is part of sysadmin by default. You are better to revoke that.