Can anyone confirm that this is a comprehensive list of the permissions?
http://www.databasesql.info/article/124980796/
Integration Services
Default instance or a named instance: SQLServerDTSUser $ ComputerName
The service capacity Login (SeServiceLogonRight,)
Write access to the application event log.
Bypass traverse checking (SeChangeNotifyPrivilege)
Authentication Impersonate a client after (SeImpersonatePrivilege)
SQL Server Agent 3
Default instance: SQLServerSQLAgentUser $ ComputerName $ MSSQLSERVER
Named instance: SQLServerSQLAgentUser $ ComputerName $ InstanceName
The service capacity Login (SeServiceLogonRight,)
As a batch job the Login (SeBatchLogonRight)
Replace a process level token (SeAssignPrimaryTokenPrivilege)
Bypass traverse checking (SeChangeNotifyPrivilege)
Adjust memory quotas (SeIncreaseQuotaPrivilege)
SQL Server
Default instance: SQLServerMSSQLUser $ ComputerName $ MSSQLSERVER
Named instance: SQLServerMSSQLUser $ ComputerName $ InstanceName
Service capacity login (SeServiceLogonRight)
As a batch job the Login (SeBatchLogonRight)
Replace a process level token (SeAssignPrimaryTokenPrivilege)
Bypass traverse checking (SeChangeNotifyPrivilege)
Adjust memory quotas (SeIncreaseQuotaPrivilege)
Permission to start SQL Server Active Directory Helper
Start SQL Writer's permission
Permission to read the event log service
Permission to read the Remote Procedure Call service
Jamie