Security setting for SQL Server services I'm currently starting to upgrade out SQL Server estate to 2012, and historical people have created two domain accounts for the database services MSSSQLServer and one for the SQL Server agent to operate under.

However I've always been concerned that in most case these have been given sysadmin rights on the SQL Server and would like to change this.  However I'm unable to find anywhere were best practice is detailed on this subject, I really want to lower this account to its minimal security requirements for starting and stopping the database but will that be enough for it to function?

Hope someone can help :-)
The engine provisioning Setup makes them sysadmin members, as documented at Configure Windows Service Accounts and Permissions:


  SQL Server Per-service SID Login and Privileges The per-service SID of
  the SQL Server service is provisioned as a Database Engine login. The
  per-service SID login is a member of the sysadmin fixed server role.
  
  SQL Server Agent Login and Privileges The per-service SID of the SQL
  Server Agent service is provisioned as a Database Engine login. The
  per-service SID login is a member of the sysadmin fixed server role.


If the product Setup makes them sysadmin is better you follow the same practice.