If you use a domain admin account for this, you will most likely fail any kind of security audit including Sarbanes-Oxley if your financial systems are tied to your active directory in ANY way. Even if you aren’t a publicly traded company, it’s not safe to hand out domain admin accounts even if they are easier to deal with in terms of security troubleshooting. While I normally will try a domain admin account during debugging to see if it’s a permissions issue, I do my best to avoid them if at all possible. If I must use one, I must.
If you want to create and use a local account in the workstations administrator group, that will give the FOG service enough rights to the local machine, but may not allow them to access network resources that are not visible to the “Everyone” group on your domain.
There is something special about the local system and network service accounts on Windows in regards to accessing remote service, but I don’t remember them offhand.
