where on a Windows Server (2008R2 or before) can I find the permissions (allow/deny) who can actually start/stop services? Not to change the credentials which should be used by the service - just start/stop.
I don't believe there is any good GUI to do this on the local system, but maybe something has been added since I last looked.
I know SetACL can be used to modify the access control list of a service. Here is an example from the documentation about how to grant the ability to start/stop the Windows Time service
You can set the permissions with the built-in sc as well, but the syntax is far more cryptic. The the options are
The other option is to set the permissions through a policy.
Also see this question: How to set Windows Services permissions from Powershell?
You can natively set permissions on services by editing the SDDL strings using SC.exe. There are several articles online that go through the details. Although using that method works, it's very tedious, error-prone and can be different depending on the OS. I haven't used SetACL Studio, but it looks pretty comprehensive based on their site.
If need to delegate rights to services on multiple machines and could possibly have more complex scenarios, I would recommend using System Frontier. You can configure permissions centrally, that can apply to one or more servers automatically without having to touch each individual server. Everything is based on role based access control (RBAC). Full disclosure: I own the company that makes System Frontier.