ecff48ad_ion_using_Domain_User_Accounts__2
[0] Default content access account [1] The default account used within a specific SSP to crawl content, unless a different authentication method is specified by a crawl rule for a URL or URL pattern. [3] - Must be a domain user account. - Must not be a member of the Farm Administrators group. - Read access to external or secure content sources that you want to crawl by using this account. - For sites that are not a part of the server farm, this account must explicitly be granted Full Read permissions on the Web applications that host the sites. The following are automatically configured: - Full Read permissions are automatically granted to content databases hosted by the server farm. [4] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - By default, in a server farm environment, the Office SharePoint Server Search service account is used until a different account is specified. After completing Setup and running the configuration wizard, change this account to a domain user account. - Do not grant the default content access account access to the directory service. For added security, use a different default content access account for each SSP. [5] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - NOT a member of the Administrators group on any server in the farm, including the computer running SQL Server. - NOT a SQL Server login on the SQL Server Host. [6] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - By default, in a server farm environment, the Office SharePoint Server Search service account is used until a different account is specified. After completing Setup and running the configuration wizard, change this account to a domain user account. - Do not give the default content access account access to the directory service. For added security, use a separate default content access account for each SSP. After the configuration database and the Central Administration content databases are created, add this account to the following for these databases: - Users group - WSS_Content_Application_Pools database role [2] 
No manual configuration is necessary if this account is only crawling local farm content. If you want to crawl remote content by using crawl rules, change this to a domain user account, and apply the requirements listed for a server farm.
MOSS How to ...: Starting and Configuring Office SharePoint Server Search for a web server with Least Privilege Administration using Domain User Accounts
2