When deploying a local FglAM and a local Infrastructure agent on to a host, does the credential lockbox need to be released or will it use the FglAM's credentials (ie the user who owns the FglAM install)?
Yes, credentials have to be released even for a locally deployed FglAM and Infrastructure agent
To get the lockbox released to the host, you need to do the following:
1) Navigate to Administration -> Credentials -> Manage Lockboxes
2) There should be one row with Name = System. Click the icon in the "Release to Credential Clients" column
3) In the popup, check the box for Name = "<your target host>"
4) Click "Release"
Releasing the lockbox will allow the local credentials to flow down to the FglAM and allow data to be collected.