ecff48ad_ion_using_Domain_User_Accounts__2
[0] Profile import default access account [1] Used to: - Connect to a directory service, such as the Active Directory directory service, a Lightweight Directory Access Protocol (LDAP) directory, a Business Data Catalog application, or other directory source. - Import profile data from a directory service. If no account is specified, the default content access account is used. If the default content access account does not have read access to the directory or directories that you want to import data from, use a different account. You can plan up to one account per directory connection. [3] - Read access to the directory service. - If Enable Server Side Incremental is selected for an Active Directory connection and the environment is Windows 2000 Server, the account must have the Replicate Changes permission in Active Directory. This permission is not required for Windows Server 2003 Active Directory environments. - Manage User Profiles personalization services permission. - View permissions on entities used in Business Data Catalog import connections. [4] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - This account can be the same account as the default content access account, or you can use a separate account. - Read access to the directory service. - Manage User Profiles personalization services permission. - This account should not be a member of the Administrators group on any computer in the server farm. [5] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - NOT a member of the Administrators group on any server in the farm, including the computer running SQL Server. - NOT a SQL Server login. [6] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - This account can be the same account as the default content access account or you can use a separate account. - Use an account that has read access to the directory service and the Manage User Profiles personalization services permission. This account should not be a member of the Administrators group on any computer in the server farm. [2] 
Same requirements as server farm.
MOSS How to ...: Starting and Configuring Office SharePoint Server Search for a web server with Least Privilege Administration using Domain User Accounts
2