CRM 2011 Error Sandbox Host - Access Denied

Okay for those of you who have stumbled upon this issue when changing Dynamics CRM to run under a custom account then here is hte solution:
Your account should be a domain user account with the following permissions as recommended by Micrsoft:

Domain User membership.

That account must be granted the Logon as service permission in the Local Security Policy.

• If you add the account as a member of local administrator then that should be sufficient.

Folder read and write permission on the \Trace, by default located under \Program Files\Microsoft  Dynamics CRM\Trace, and user account %AppData% folders on the local computer.

Read permission to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM subkey in the Windows Registry.

The service account may need an SPN for the URL used to access the Web site that is associated with it. To set the SPN for the Sandbox Processing Service account, run the following command at a command prompt on the computer where the service is running.

SETSPN –a MSCRMSandboxService/<ComputerName> <service account>

If you want to change your Dynamics CRM web app to run under this account  then you will need to do some more stuff

The account should be in the sysadmin group of the SQL Server where your crm database is located.

The account should be in the SQLAccessAGroup

Add to CRM_WPG group

Add to PrivUserGroup (this is usually missed)

Hope this helps someone out there.