A login can be granted CONTROL SERVER rights,
CREATE LOGIN test WITH PASSWORD = ‘myPassword123’;
GRANT CONTROL SERVER TO test;
CONTROL SERVER rights allows a login to do anything in SQL Server, but there is one subtle difference with sysadmin.
It is possible to explicitly DENY connect to the login with CONTROL SERVER right ,
DENY CONNECT TO test;
Members of the syadmin bypass the DENY
Republished from http://www.sqlserver-dba.com.