Which AD permission is required to allow impersonation of an account

Sounds like you need to generate a new Security Identifier (SID). Make sure the machine is joined to a "Workgroup" instead of "Domain" (If you've tried to make it be in the domain and it failed but still shows as being in the domain, disjoin and reboot). Next download and run SysInternal's NewSID Application

From: http://technet.microsoft.com/en-us/sysinternals/bb897418.aspx

How it Works

NewSID starts by reading the existing computer SID. A computer's SID is stored in the Registry's SECURITY hive under SECURITY\SAM\Domains\Account. This key has a value named F and a value named V. The V value is a binary value that has the computer SID embedded within it at the end of its data. NewSID ensures that this SID is in a standard format (3 32-bit subauthorities preceded by three 32-bit authority fields).

Next, NewSID generates a new random SID for the computer. NewSID's generation takes great pains to create a truly random 96-bit value, which replaces the 96-bits of the 3 subauthority values that make up a computer SID.

Three phases to the computer SID replacement follow. In the first phase, the SECURITY and SAM Registry hives are scanned for occurrences of the old computer SID in key values, as well as the names of the keys. When the SID is found in a value it is replaced with the new computer SID, and when the SID is found in a name, the key and its subkeys are copied to a new subkey that has the same name except with the new SID replacing the old.

Reboot after computer has been renamed, and try joining it to the Domain again.

Unless you have something wrong with your domain, or have specifically set things up so that the Domain Administrators group is not a members of the local Administrators group then Domain Administrators will automatically be full admins on your Windows 7 Machine with identical UAC behavior to the local Administrator account. The same applied to Vista so if you actually needed to take this extra step for Vista something sounds wrong to me.

When you are part of a domain you should be using a Domain Administrator account by preference, the local Administrator account should only be used as a final recourse (e.g. if a machine gets kicked off the domain for some reason, or the domain is unavailable and there are no cached Domain Administrator credentials).