When you create a performance alert, by default it runs as the Network Service account. However, you can specify a different account for its execution. If you specify another account, ensure that the named account has the following rights:
* Read access to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionPerflib
* Full Access to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSysmonLog and its subkeys
* Read access to the files %windir%system32PERFC*.dat and %windir%system32PERFH*.dat
