The service account needs read and write access. That should be all a
vanilla installation needs. However, I would also give local administrators
and system access as well. They could get access if they really wanted it
and it may save problems down the road.