We are deploying SQL Server Express with our .NET application, i.e., our own SQL Server Express instance is automatically installed during the setup process of our application.

During unattended installation, one can specify the user account that should be used for the SQL Server Agent (via the command-line parameter `/AGTSVCACCOUNT`, which is non-optional). However, it seems that all options are either (a) unfeasible or (b) not recommended by Microsoft:

* `NT AUTHORITY\NetworkService` and `NT AUTHORITY\LocalService`: These options are [not supported on domain controllers](http://msdn.microsoft.com/en-us/library/ms345380.aspx). (In terminal server environments, our bussiness application is sometimes installed on domain controllers. I know it's not best practice, but that's just what our customers do sometimes.)
* `NT AUTHORITY\System`: [Microsoft says](http://msdn.microsoft.com/en-us/library/ms191543.aspx): "The Local System account option is provided for backward compatibility only. The Local System account has permissions that SQL Server Agent does not require. Avoid running SQL Server Agent as the Local System account."
* Automatically creating a new local Windows or domain user: I don't think this is a feasible option. As a user, I would consider it quite intrusive, if a *simple business application* I install on my machine automatically creates a new user account. Anyway, which password should be used? Some predefined, hard-coded value (= security nightmare)? Some new random password (= administration nightmare)?
* Ask the user to provide or create an account: In many cases, the "simple user" installing the software on his home computer neither know nor cares what a "user account" it, so this is not an option either. Anyway, why should the user be bothered with some internal implementation detail (the SQL Server Agent service) of the business application he is installing?

Did I miss anything obvious? Are there some well-established best practices on how to solve this issue?