'права запуска/остановки для любого пользователя
      DoAccessNTService "Имя_службы", GENERIC_READ Or GENERIC_EXECUTE

Public Const GENERIC_ALL = &H10000000
'для SE_SERVICE это в частности дает право не только запускать/останавливать, но и удалять сервис

Public Const GENERIC_READ = &H80000000
'для SE_SERVICE это означает:
' STANDARD_RIGHTS_READ
' SERVICE_QUERY_CONFIG
' SERVICE_QUERY_STATUS
' SERVICE_INTERROGATE
' SERVICE_ENUMERATE_DEPENDENTS

Public Const GENERIC_EXECUTE = &H20000000
'для SE_SERVICE это означает:
' STANDARD_RIGHTS_EXECUTE
' SERVICE_START
' SERVICE_STOP
' SERVICE_PAUSE_CONTINUE
' SERVICE_USER_DEFINED_CONTROL

Public Const SERVICE_START = &H10&
Public Const SERVICE_STOP = &H20&


Public Function DoAccessNTService(ServiceName As String, dwAccessRights As Long) As Long
  DoAccessNTService = AddAceToObjectsSecurityDescriptor(ServiceName, _
   SE_SERVICE, _
   ConstructUniversalAndNTWellKnownSids("Users"), _
   dwAccessRights, _
   GRANT_ACCESS, _
   NO_INHERITANCE)
  If DoAccessNTService <> ERROR_SUCCESS Then
    AddLog "  Calling AddAceToObjectsSecurityDescriptor... Failed. Error code: " & RaiseAPIErrorByNumber(DoAccessNTService)
  Else
    AddLog "  Calling AddAceToObjectsSecurityDescriptor... Done."
  End If
End Function


Public Function AddAceToObjectsSecurityDescriptor(pszObjName As String, _
 ObjectType As SE_OBJECT_TYPE, pszTrustee As String, _
 dwAccessRights As Long, AccessMode As ACCESS_MODE, dwInheritance As Long) As Long
'DWORD AddAceToObjectsSecurityDescriptor (
'    LPTSTR pszObjName,          ' name of object
'    SE_OBJECT_TYPE ObjectType,  ' type of object
'    LPTSTR pszTrustee,          ' trustee for new ACE
'    TRUSTEE_FORM TrusteeForm,   ' format of trustee structure -<&#237;&#229; &#237;&#224;&#228;&#238;
'    DWORD dwAccessRights,       ' access mask for new ACE
'    ACCESS_MODE AccessMode,     ' type of ACE
'    DWORD dwInheritance         ' inheritance flags for new ACE
')
 
  Dim dwRes As Long
  Dim pOldDACL As Long, pNewDACL As Long
  Dim pSD As Long
  Dim ea As EXPLICIT_ACCESS
 
  If (pszObjName = "") Then
    AddAceToObjectsSecurityDescriptor = ERROR_INVALID_PARAMETER
    Exit Function
  End If
  
  'Get a pointer to the existing DACL.
  dwRes = GetNamedSecurityInfo(pszObjName, ObjectType, _
   DACL_SECURITY_INFORMATION, _
   0&, 0&, pOldDACL, 0&, pSD)
  If dwRes <> ERROR_SUCCESS Then
    AddLog "    Calling GetNamedSecurityInfo... Failed. Error code: " & RaiseAPIErrorByNumber(dwRes)
    'MsgBox "GetNamedSecurityInfo Error " & CStr(dwRes)
    GoTo Cleanup
  Else
    AddLog "    Calling GetNamedSecurityInfo... Done."
  End If
  
  'Initialize an EXPLICIT_ACCESS structure for the new ACE.
  BuildExplicitAccessWithName ea, pszTrustee, dwAccessRights, AccessMode, dwInheritance
  
  ' Create a new ACL that merges the new ACE into the existing DACL.
  dwRes = SetEntriesInAcl(1, ea, pOldDACL, pNewDACL)
  If dwRes <> ERROR_SUCCESS Then
    AddLog "    Calling SetEntriesInAcl... Failed. Error code: " & RaiseAPIErrorByNumber(dwRes)
    'MsgBox "SetEntriesInAcl Error " & CStr(dwRes)
    GoTo Cleanup
  Else
    AddLog "    Calling SetEntriesInAcl... Done."
  End If

  'Attach the new ACL as the object's DACL.
  dwRes = SetNamedSecurityInfo(pszObjName, ObjectType, _
   DACL_SECURITY_INFORMATION, _
   0&, 0&, pNewDACL, 0&)
  If dwRes <> ERROR_SUCCESS Then
    AddLog "    Calling SetNamedSecurityInfo... Failed. Error code: " & RaiseAPIErrorByNumber(dwRes)
    'MsgBox "SetNamedSecurityInfo Error " & CStr(dwRes)
    GoTo Cleanup
  Else
    AddLog "    Calling SetNamedSecurityInfo... Done."
  End If

Cleanup:
  If pSD <> 0 Then LocalFree pSD
  If pNewDACL <> 0 Then LocalFree pNewDACL
  
  AddAceToObjectsSecurityDescriptor = dwRes
End Function