Our advice is to create a dedicated ITP/Server account and run the ITP/Document Processors under this 'user' account. Refer for the rights this account needs to the Security chapter 11.3 ITP/Server Account.