The Vault Service account must be a member of the Active Directory domain. We recommend that you do not make this account a Domain Administrator. It is better to assign Exchange Server permissions explicitly.