Our build AD account needed the ability stop/start Windows services so that it can deploy them. I looked all around and found a simple solution using the subinacl utility from Microsoft (For more info see "Method 3" on this page.) The following command will give an AD user full rights to the service specified. I tried to only give it stop and start permissions but couldn't figure out the right combination of flags to make this happen (And no its not 'TO').

SUBINACL /SERVICE \\MyServer\MyServiceName /GRANT=MyDomain\MyUser=F