How to configure a non-domain admin audit agent service account (4316887)

The Active Administrator installation guide lists the user privilege requirements for the Active Administrator Agent, but the permissions listed do not appear to be enough:

Active Administrator Agent can run under a domain user account provided it is either a local administrator account, which gives it the rights to log on as a service, log on locally and manage auditing and security log, or these privileges can be granted individually. This user or service account should also be a member of the AA_Admin group.

Issue: When the audit agent is restarted, it stops writing to the database if it is not a member of the Enterprise Admin group or built in Administrators.