Credentials on Domain Controllers

For credentials on Domain Controllers, besides local admins rights (which is not recommended since it would make the credential a domain admin) what other access levels are able to work?