How can I set the permission on the CRM Setup Account in AD, so that it has the right to create SPNs

Hi,

My CRM installation keeps failing on the AD part.

It says that the account that I am using doesn't have the permission to set the SPNs on the MSCRMSandbox and Async Service, and that I should either assign the permission, or run setup again using a Domain Admin account.

I am trying to use a least privileged account.  

Do you know how I can set the permission on the account, so that it can create the necessary SPNs?

Thanks