Log on as a service
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
Determines which service accounts can register a process as a service.
This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.
By default, no accounts have the privilege to log on as a service.