I don't know what the isMSShipped property is myself. As far as default privledges for roles, look up Roles in Books Online and it will give you a list of what each Server Role and each Database role can do.
FYI, all roles, fixed or DBA created, have to be manually assigned to users except SA automatically gets SysAdmin access as well as whatever domain user account you specify for the services to use during install.
You can audit changes to logins via Profiler, if that's what you're looking for. You can audit alterations, additions, and drops. I don't know of anything in SQL that actually tracks a history of these changes, though. I honestly don't think SQL keeps a history of changes. Except, perhaps, a CreateDate and UpdateDate (See SysUsers in SQL 2000 and Sys.Database_Principals in SQL 2005).
Hope this helps.
Catadmin - MCDBA, MCSA
"No, no. Yes. No, I tried that. Yes, both ways. No, I don't know. No again. Are there any more questions?"
-- Xena, "Been There, Done That"