Hi Seb,
Adding the service account to the local administrator groups raises a question as to why it should be added when the Windows AD authentication has been working fine for about 2 years now.
Adding the service account might be the best practice, but the question is why it is such a need when it can be accomplished without adding it. I talked to my Network Admin and he said the configuration guides comes with lot of settings, but we need to see what suits us best.