What privileges are required for Certificate Authority agent account provided by Active Directory cartridge (4285633)

The Active Directory cartridge an agent can monitor Certificate Authoirty (CA) status. What privileges are required for this agent account for successful monitoring?

In order to run remote scripts, a Certificate Authority agent requires an account with relevant privileges:

• If the Certificate Authority server is a member server then agent account needs to be member of Domain Admins group.
• If the Certificate Authority server is a Domain Controller then the agent account needs to be member of either Domain Administrators group or Domain Admins group.