We are disallowed from having a service account in the domain admin group. The acceptable workaround is that the service account is manually put into the built-in administrator's group on each DC. This gives full access to the host and all running processes for the purpose of discovery but does not in and of itself grant any domain privileges. The only reason this needed any exception at all is that if the credential is compromised that account could logon to a DC and put itself into the domain admin group. But having an account that could elevate itself was much more acceptable than having an elevated account.
