Marvin,
The agents are installed with a local admin credential. When it creates the services SecureSphere Agent service, it is set to run with NT Authority, so all the agent activity is run with NT Authority permissions, including the data interface discovery. This is normal.
------------------------------
Paul Hammons
Imperva Senior Sales Engineer
Cape Coral, Florida
------------------------------