Rights for relayuser and directory services user
The relayuser account can be renamed and moved. If it is renamed, then you have to go into the 8090 console under the relay properties and tell it the new name.
What rights does the relayuser account need? The relayuser account needs to have access to read the Relay Configuration objects.
What rights does the Directory Services Account Need: It needs to have access to containers, groups, users, basically any object that you need to make work with the portal. Initially, you need to have access to the schema to update it the first time webnetwork starts. After that, it only needs that during hot fix updates.