function IsService( var bIsService: BOOL; var dwError: DWORD ): BOOL;
type
  LONG = LongInt;

  LUID = record
    LowPart:  DWORD;
    HighPart: LONG;
  end;

  TOKEN_TYPE = TTokenType;
  SECURITY_IMPERSONATION_LEVEL = ( SecurityAnonymous, SecurityIdentification, SecurityImpersonation, SecurityDelegation );

  TOKEN_STATISTICS = record
    TokenId:            LUID;
    AuthenticationId:   LUID;
    ExpirationTime:     LARGE_INTEGER;
    TokenType:          TOKEN_TYPE;
    ImpersonationLevel: SECURITY_IMPERSONATION_LEVEL;
    DynamicCharged:     DWORD;
    DynamicAvailable:   DWORD;
    GroupCount:         DWORD;
    PrivilegeCount:     DWORD;
    ModifiedId:         LUID;
  end;
const
  SECURITY_NT_AUTHORITY: TSIDIdentifierAuthority = ( Value: ( 0, 0, 0, 0, 0, 5 ) );
  SECURITY_SERVICE_RID = 6;

  SYSTEM_LUID:          LUID = ( LowPart: $3E7; HighPart: $0 );
  ANONYMOUS_LOGON_LUID: LUID = ( LowPart: $3E6; HighPart: $0 );
  LOCALSERVICE_LUID:    LUID = ( LowPart: $3E5; HighPart: $0 );
  NETWORKSERVICE_LUID:  LUID = ( LowPart: $3E4; HighPart: $0 );

  function EqualLuid( const l1, l2: LUID ): Boolean;
  begin
    Result := ( l1.LowPart = l2.LowPart ) and ( l1.HighPart = l2.HighPart );
  end;

var
  hToken: THandle;
  dwSize: DWORD;
  ts: TOKEN_STATISTICS;
begin
  Result := False;
  if not OpenProcessToken( GetCurrentProcess, TOKEN_QUERY or TOKEN_QUERY_SOURCE, hToken ) then begin
    dwError := GetLastError;
    Exit;
  end;

  try
    dwSize := 0;
    if not GetTokenInformation( hToken, TokenStatistics, @ts, sizeof( ts ), dwSize )  then begin
      dwError := GetLastError;
      Exit;
    end;

    Result := True;
    bIsService := EqualLuid( ts.AuthenticationId, SYSTEM_LUID )
                  or
                  EqualLuid( ts.AuthenticationId, LOCALSERVICE_LUID )
                  or
                  EqualLuid( ts.AuthenticationId, NETWORKSERVICE_LUID );
  finally
    CloseHandle( hToken );
  end;
end;