[0] Office SharePoint Server Search service account [1] Used as the service account for the Office SharePoint Server Search service. There is only one instance of this service and it is used by all SSPs. [3] - Must be a domain user account. - Although it is written in the Microsoft .doc documentation "Must be a member of the Farm Administrators group on the server" if you refer to the HTML documentation, it is written "Must not be a member of the Farm Administrators group". I flagged this mismatch as a bug to Technet and think that this account must not be a member of the Farm Administrators group. (see this post comments) The following are automatically configured: - Access to read from the configuration database. [4] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. [5] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. - NOT a member of the Administrators group on any server in the farm, including the computer running SQL Server. - NOT a SQL Server login. [6] Server farm standard requirements with the following additions or exceptions: - Use a separate domain user account. After the configuration database and the Central Administration content databases are created, add this account to the following for these databases: - Users group - WSS_Content_Application_Pools role After the SSP database and the SSP search database are created, add this account to the following for each of these databases: - Users group - db_owner role [2] 
By default, this account runs as the Local System account. If you want to crawl remote content by changing the default content access account or by using crawl rules, change this to a domain user account. If you do not change this account to a domain user account, you cannot change the default content access account to a domain user account or add crawl rules to crawl this content. This restriction is designed to prevent elevation of privilege for any other process running as the Local System account.