Why the Notification Server Application Identity should have Domain Admin rights