...
- Log on as a service (to run as Windows service)
- Start/Stop service (to run as Windows service, necessary for the agent upgrade to work, see also Microsoft KB article)
- Debug programs (required for take process dump functionality to work)
Reboot the machine (for required for agent reboot functionality to work)
To be able to monitor performance of a build agent run as a Windows service, the user starting the agent must be a member of the Performance Monitor Users group
...