Guidance on Service and Batch Accounts

We are working on adjusting our PeopleSoft 9.2 installation (8.56 tools) and could really use some guidance.

In particular we are looking at our service accounts and batch accounts as a potential attack vector as multiple people have access to the accounts.

With service accounts we intend to take out any PIA access and trim them down to only the needed permissions.

With Batch accounts, they need to be able to login manually so we are contemplating moving the permissions to the individual users that need them; however, the users in charge of the areas that have the batch accounts have stated previously that the run controls they have had to setup are particularly ominous and they would appreciate not having to set them up again.