The default administrator account is no longer a member of BuildIn\Administrators group is what I was going off of. That group is almost always mentioned in reference to the built-in local group in Windows land, IME. Though you're right, you didn't explicitly say anything about local groups, and I read that into your question and answer (which I realize is a lot more ambiguous than it first appeared, now that I've re-read them.).

Wow, that's a total dumpster fire, indeed. I would reiterate that Windows Domain controllers don't have local accounts, so you may have thought you were logging in with a local account, but you weren't. Like servers, Windows domains have built-in users and groups, and I think you're just confusing the built-in local accounts with the built-in domain accounts. Also, your question doesn't mention SBS, which would have been an important detail, because SBS is a dumpster fire in its own right.

@PatrikN The last couple domains I stood up, I did so using a local administrator account named "setup" that was not a built-in default, and I'm almost 100% sure that I didn't end up with a "setup" domain account in the new domains. I can't recall off the top of my head if the default, built-in domain\Administrator account is related to the default, built-in local Administrator account from the member server that's promoted to the first domain controller, but that's kind of academic - either way, the two are distinct accounts, with different GIUDs and SIDs.

Well, it’s VLQ because the OP doesn’t understand how domain controllers work. They don’t really have local accounts, and the default Adminstrator account is only accessible when booting into DSRM (directory services restore mode), not normal operation. So, actually, that self answered QA is a raging dumpster fire, and probably should be deleted, though not for the reasons given by the OP here.