You could use DLL injection to call
SetCurrentDirectory after the process has already launched. This would require you to build an injector application, plus the DLL to inject. Some tutorials exist; probably the two best ones I've found are:
You'll need a decent amount of C++ programming background (and a working build environment) to get through that.
However, this assumes that the service is looking at the current directory. Another possibility is that it's using
%path%. You say that it "starts at
system32, tries a few more locations, and eventually its own directory", so this seems more likely to me.
Compare the directories you see in
procmon with your
%path%. If they're the same, consider modifying either the
SYSTEM %path% or the
%path% of the user running the service, so that the directory you want it to search is first.
I believe Fred is right, though -- you're unlikely to see any significant performance benefit by doing any of this, unless it's happening very frequently. Simple file open operations are not particularly expensive, especially if it's a local path and the file doesn't actually exist.