Rights the SMA service account needs on a workstation