Its the same for all, a domain accout with the minimum privlages, the account needs to be able to run as a service if you apply restricted group policies accross your domain