Permits spooler restart to user, take a look here (in italian): https://go.gioxx.org/userspoolerrestart
Sources:
https://www.winhelponline.com/blog/view-edit-service-permissions-windows/
https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights
| Abbreviation | Security Principal |
| AU | Authenticated Users |
| BA | Built-in administrators |
| SY | Local System |
| BU | Built-in users |
| WD | Everyone |
Security Descriptors meaning
| D: | Discretionary ACL (DACL) |
| S: | System Access Control List (SACL) |
| ACE type | Meaning |
| A | Access Allowed |
| ACE flags string | Meaning | |
| CC | SERVICE_QUERY_CONFIG | Query the SCM for the service configuration |
| LC | SERVICE_QUERY_STATUS | Query the SCM the current status of the service |
| SW | SERVICE_ENUMERATE_DEPENDENTS | List dependent services |
| LO | SERVICE_INTERROGATE | Query the service its current status |
| RC | READ_CONTROL | Query the security descriptor of the service |
| RP | SERVICE_START | Start the service |
| DT | SERVICE_PAUSE_CONTINUE | Pause/Resume the service |
| CR | SERVICE_USER_DEFINED_CONTROL | |
| WD | WRITE_DAC | Change the permissions of the service |
| WO | WRITE_OWNER | Change the owner in the object’s security descriptor. |
| WP | SERVICE_STOP | Stop the service |
| DC | SERVICE_CHANGE_CONFIG | Change service configuration |
| SD | DELETE | The right to delete the service |