Which rights does the SMA (Symantec Management Agent) service account need on a workstation?

8.x

The 'aexnsclient' service should run under SYSTEM account, we execute some code that requires SYSTEM privileges.

Now, about NS appid account or if ACC (Agent Connectivity Credentials) is used, this one does not have to belong to any group, it is used for authentication on the remote machine (PS/TS/NS) only, it is not impersonated locally, ever.

"Security rights needed by the Agent Connectivity Credentials" (KB 150567)
"Altiris Notification Server and Altiris Agent user Security requirements" (KB 179482)
"Common Credentials used for ITMS" (KB 181041)