Does the cloudbase init account require administrator permissions after building a machine

edit

We currently are running cloudbase init to provision our windows images in openstack. When the machine is spun up and in working order, the cloudbase init account is still a member of the local administators group on the local machine. The service is no longer running as windows is active. Can we remove the cloudbase init account out of the local administrators group or is the account still required to have these memberships even after the machine is built? or, can we remove the cloudbase init account out of local admin and change the service to run with the local system account instead of the cloudbase init account?