These guys deserve some props for their Services Security Editor; from Core Technologies. It works really well to modify permissions on services. For example, you have a developer who only has RDP access to a server, but you want him to be able to restart ONE single service he supports. This is the tool. Think of SUBINACL with a GUI!  http://www.coretechnologies.com/products/ServiceSecurityEditor/