A domain user account is required to provide a network identity for AD RMS so that it can communicate with other services ...

A domain user account is required to provide a network identity for AD RMS so that it can communicate with other services on this computer and the network. The domain account should be a standard domain user account with no additional permissions. Although installing AD RMS on a domain controller is not recommended, if you are installing AD RMS on a domain controller, the domain account that you specify must be a member of the Domain Administrators group or of the Enterprise Administrators group.

Specify the account under which the AD RMS cluster will run, using the format DomainName\UserName. The AD RMS service account will be a member of the AD RMS service group and will have the permissions defined for that group.