setting permissions for windows services is really awful.
just want to allow a nonadmin to start and stop my php worker:
sc sdshow php5-cgi-worker01 D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPDT;;;S-1-5-21-<snip>-<snip>-<snip>-1000)
permissions can be set with
sc sdset ...
the easier way is to use SubInACL as admin:
subinacl.exe /service php5-cgi-worker01 /grant=username=PTO
(P = pause, T = start, O = stop)
then you can start the service with your user:
sc start php5-cgi-worker01