A nice little tool to manage service permissions on Windows name subinacl is available at https://www.microsoft.com/en-gb/download/details.aspx?id=23510

Default install directory is “C:\Program Files (x86)\Windows Resource Kits\Tools”
Usage example for the ‘spooler’ service and the user domain\username:

subinacl /service spooler /grant=domain\username=top