aa363691_leged_Installation___Nik_Patel__2
[0] SharePoint Farm Account(e.g. sp_farm) [1] Specify this account in farm configuration wizard while configuring SharePoint during farm creation process This account is automatically configured by SharePoint Configuration Wizard. Also known as Database Access Account for the SharePoint_Config database on the SharePoint Configuration Wizard. Used for Configuring and Managing the SharePoint Farm. Becomes the owner of the farm. In other words, its configured as a dbowner of the SharePoint Config database. Using this account, you can add additional farm administrators from the central administration site. [3] Although it is not required for full time term, farm account should be Member of Local Administrators Group on each server where SharePoint Installer would run (aka. WFE and Application Servers, excluding SQL Server or SMTP Server). It will provide ease of access for the SharePoint Admins. Must be on the Member of Local Administrators Group on the server during UPS Service provisioning process. [4] None [5] IIS Application Pool Identity Changes – Act as an application pool identity for the SharePoint Central Admin. Windows Services Changes – Runs the SharePoint Foundation Timer Service (SPTimerV4) Managed Accounts in Central Admin Changes – This account will be registered as Managed Service Account in the Configure Managed Accounts page Service Accounts in Central Admin Changes – This account is added as Farm Account in the Configure Service Accounts page. AD Group Membership Changes – After you run the configuration wizards, Additional permissions are automatically granted to the server farm account on Web servers and application servers that are joined to a server farm. Membership in the WSS_ADMIN_WPG Windows security group for the SharePoint Foundation 2010 Timer service. Membership in WSS_RESTRICTED_WPG for the Central Administration and Timer service application pools. Membership in WSS_WPG for the Central Administration application pool. Member in the built-in IIS_IUSRS on IIS 7 (Windows Server 2008) and IIS 7.5 (Windows Server 2008 R2), IIS_IUSRs replaces earlier version IIS_WPG built-in group SQL Database Changes – After you run the configuration wizards, SQL Server and database permissions for sp_farm includes: Added as SQL Server Login to DB Server Added as DBCREATOR fixed server role because when you create new web applications and content databases, Central Administration’s application pool identity (sp_farm) has to be able to create those databases on the SQL server. Added as SECURITYADMIN fixed server role because Central Admin can create SQL Server logins when you create managed accounts or modify app pool identities. Each web application pool’s identity must have a login for that web application’s content databases. Added as a DB_OWNER fixed database role for all the SharePoint databases (e.g. configuration databases, service application databases, or content databases) on the farm. Added as a WSS_CONTENT_APPLICATION_POOLS and SHAREPOINT_SHELL_ACCESS fixed database roles for the SharePoint Server 2010 server SharePoint_Config and SharePoint_AdminContent databases. [2] 
Can be local user account or domain user account. Must be domain account if SQL Server is hosted on another server.
SharePoint 2010 Service Account References for Least-Privileged Installation | Nik Patel
2