I'm trying to have an NSIS Installer install a custom service as part of an installation. It would be nice to run the service with one of those typical 'NT Service\xyz' style virtual service accounts available in Win 7 and newer. As you might have guessed from the Win7, this is a deployment on a client machine, not a server.
It works just fine in my testing machine, but I have some doubts about the correct approach to permissions for this service user, especially when domain GPOs might be in effect.
In the simple case, the service gets its 'Log on as a service' permissions via the NT SERVICE\ALL SERVICES membership, but i have seen cases where this isn't the case and this group has the permissions explicitly revoked via GPO.
So the question is: Should an Installer for a client machine explicitly create/configure an ACL to grant 'Logon as a Service' to the newly created virtual service user, or should it hope/rely on the default 'NT Service\All Services' group to grant this permissions?