active directory error sensor. user permissions

I really need to know what type of user and what user permissions are required to add an AD replication sensor. Currently we have created a user of the domain admin type, but when configuring we get access denied message. Do you also need this domain admin account to be added locally on each Active directory server to monitor? The user must be locally in the local Administrators group of each active directory server ?. What permissions need to be granted locally to this user? At the domain level (active directory user and computer), should any additional permission be granted to the created user (for example monitor Active directory replication)? Ideally, Paessler delivers an implementation note with this list of necessary permits. Please if someone is clear about this configuration share it. Thank you very much