We're in the process of hardening DMAs for one of our clients by removing local admin accounts to adhere to security policies set by InfoSec. In a separate Dojo post called, How to Disable Windows Administrator in Production DMS? this seems to be quite doable, but I have a question. Wouter said in the comments:

Hi Bruno, it is a misconception that agents communicate with each other using the Administrator account by default.

The default behavior is that the machines try to authenticate using their system/machine account. This usually works as machines are in the same domain.

Currently each DMA has a local account with the same UN/PW that has local admin rights. In the past I recall we attempted to use a domain account instead of a local admin when installing the DM software and ran into a lot of problems with communications between the DMAs. Unfortunately it's been a while and I don't remember the exact error, but it was something about unauthorized users. I do seem to think by rerunning the installers with the local admin account, it cleared things up.

Based on what I read in the article posted above, it seems we SHOULD NOT have had issues, so I'm trying to figure out what happened to make sure we can avoid that problem when we remove the local admin accounts. We'd like to avoid using connection strings, but I'm unsure what we need to do to make sure the "default behavior" is successful. Are there any requirements we can check, procedures to test or other suggestions prior to removing the local admin accounts just to make sure we don't break anything?

Thanks!