when my C# service impersonates a secondary account does the secondary
account need any special permissions? what are they?