sa permissions

Is there anyway to reduce the permissions of the sa user so it does not have
local administrator access?

ie running something like xp_cmdshell 'net user /add' should return access
denied?

Thanks,


.