Steve Jones, you wrote;

sysadmins alias to dbo.

Remove the builtin_admins from the sysadmin group.

I already removed the sysadmins role from the BUILTIN\Administrators login but this Windows group still has rights...