Security rights needed by the Agent Connectivity Credentials. 

When using a separate account for your agent connectivity credentials, there are no special permissions that need to be added in Active Directory or Windows. The permissions it needs to access the package shares will be added automatically by the package server component. 

If you are not using a domain account, it is recommended that you use the 'Create the Agent Connectivity Credential on Package Servers' option in Package Service Settings. 

Settings > Notification Server > Site Server Settings > Package Server Settings

See also: 179482 "Altiris Notification Server and Altiris Agent user Security requirements"