Deny logon as a service
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
Determines which service accounts are prevented from registering a process as a service. This policy setting supercedes the Log on as a service policy setting if an account is subject to both policies.
This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.
By default, there are no accounts denied logon as a service.