I needed to grant permissions to a non-administrative domain user to be able to start and stop services. The subinacl command can be used to grant these permissions:
subinacl /service \\ComputerName\ServiceName /grant=[Domain\]Username[=Access]
Here are the available ‘Access’ parameters:
F : Full Control
R : Generic Read
W : Generic Write
X : Generic eXecute
L : Read controL
Q : Query Service Configuration
S : Query Service Status
E : Enumerate Dependent Services
C : Service Change Configuration
T : Start Service
O : Stop Service
P : Pause/Continue Service
I : Interrogate Service
U : Service User-Defined Control Comma