Thanks. It's really hard when you can't just see the instance in question :-D.

So are you saying that if you untick Sysadmin under Server Roles and save it, this prevents that person logging in at all? I wonder if they are missing a default database? In General, what is their default database?