SMS uses the Client Services DC account (SMS&_domain_controller_name) to run client services on domain controllers. SMS deletes this account after the client components are removed from the domain controller.
While it exists, the Client Services DC account is a member of the local Administrators group on each client computer and has these rights on clients:
Related Topics
SMS Accounts Configuration Overview