ecff48ad_ion_using_Domain_User_Accounts__2
[0] Office SharePoint Server Search service account [1] Used as the service account for the Office SharePoint Server Search service. There is only one instance of this service and it is used by all SSPs. [3] - Must be a domain user account. - Although it is written in the Microsoft .doc documentation "Must be a member of the Farm Administrators group on the server" if you refer to the HTML documentation, it is written "Must not be a member of the Farm Administrators group". I flagged this mismatch as a bug to Technet and think that this account must not be a member of the Farm Administrators group. (see this post comments) The following are automatically configured: - Access to read from the configuration database. [4] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. [5] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - NOT a member of the Administrators group on any server in the farm, including the computer running SQL Server. - NOT a SQL Server login. [6] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. After the configuration database and the Central Administration content databases are created, add this account to the following for these databases: - Users group - WSS_Content_Application_Pools role After the SSP database and the SSP search database are created, add this account to the following for each of these databases: - Users group - db_owner role [2] 
By default, this account runs as the Local System account. If you want to crawl remote content by changing the default content access account or by using crawl rules, change this to a domain user account. If you do not change this account to a domain user account, you cannot change the default content access account to a domain user account or add crawl rules to crawl this content. This restriction is designed to prevent elevation of privilege for any other process running as the Local System account.
MOSS How to ...: Starting and Configuring Office SharePoint Server Search for a web server with Least Privilege Administration using Domain User Accounts
2