To your 3rd question: We had same probleme with an external 3rd-party-command which has to run in a different context.
Our (not satisfying) solution was to run the orchestrator service not with SYSTEM account, but with a user account (we have special administrative accounts for applications). But this is not officially supported by VMware (we had some support issues, not related to this, and it was never a problem).
We also have no problems with running orchestrator with a separate user account.
(discussed in this thread http://communities.vmware.com/thread/280865?tstart=50 )