SQL security question

Hi Folks 

im hoping this is a quick question /answer looking at reducing our security logins i have on our SQL box.

i've got some users that have roles ticked for example public & sysadmin but no DB is mapped to that user. would that mean that user still has access to do stuff or would they need a DB mapped in order to do anything? 

Thanks

Sarah