This is one I will not remember; granting permissions to a domain user to control a Windows service. Needed to grant our build user this permission. Here is an article that demonstrates how to do it with SUBINACL.

SUBINACL /SERVICE \\MyServer\SomeService /GRANT=MyDomain\MyUser=F

Here are the permissions:

F : Full Control
R : Generic Read
W : Generic Write
X : Generic eXecute
L : Read controL
Q : Query Service Configuration
S : Query Service Status
E : Enumerate Dependent Services
C : Service Change Configuration
T : Start Service
O : Stop Service
P : Pause/Continue Service
I : Interrogate Service
U : Service User-Defined Control Commands