When we connect to the harvest agent we pass a encrypted dfo file that has the user ID and password. My question is what rights are needed for that ID. do they need remote log in to communicate or just a functional ID that does not allow server log in?
The userid you use to connect to a SCM Agent process must have login rights to the machine. In addition, the userid would need read/write permissions to whatever folders and files are required, and execute permissions to any scripts or commands you would want to execute remotely using the "hexecp" command.