What rights does the SMA (Symantec Management Agent) service account need on a workstation?

The 'aexnsclient' service should run under SYSTEM account, we execute some code that requires SYSTEM privileges.

Now, about NS appid account or if ACC (Agent Connectivity Credentials) is used, this one does not have to belong to any group, it is used for authentication on the remote machine (PS/TS/NS) only, it is not impersonated locally, ever.