PageGate service allowed to interact with Desktop setting

[mcguffin]

I saw that this is enabled on install now after 10.0.11. Does PageGate service require this? My Cyber team is wanting to know if we can modify or do something to limit the permissions. Would creating a local user account for the service to run as change this behavior?

The thing in particular my Cyber team is asking about:
Path : c:\program files (x86)\notepage\pagegate\pagegate.exe
Used by services : PageGate
File write allowed for groups : Users (S-1-5-32-545)

I found the documentation that says the account should have "Create service" and "Log on as service" policies. Anything else required?

Thanks.

[Tech Support]

We have found that on some systems where heap memory is limited, having the "Interact with desktop" setting enabled can help reduce the amount of heap memory that PageGate uses. On most systems this isn't necessary, but we use it as the default, in order to avoid those rare cases. In all likelihood you can disable that setting with no adverse effects.