Not sure if you're still looking for help here. I haven't done this for a while. We got out of the practice of delegating service control and just make a few of our app owners local admins now.
You can use Subinacl to modify the service permissions:
subinacl /service SERVICE_NAME /grant=DOMAIN\GROUP=F
Use the true service name (usually no spaces), not the display name (usually has spaces)
The SC command only works for remote service control if it has FULL control of the service. All permissions the can be delegated are listed below.
F : Full Control
R : Generic Read
W : Generic Write
X : Generic eXecute
L : Read controL
Q : Query Service Configuration
S : Query Service Status
E : Enumerate Dependent Services
C : Service Change Configuration
T : Start Service
O : Stop Service
P : Pause/Continue Service
I : Interrogate Service
U : Service User-Defined Control Commands
There is also a one time step to allow services to be controlled remotely if the server is 2003 SP1 or later:
SP1 changed the default ACL on the service control manager. Remote use of services.msc does not work with the SP1 version of ACL.
Change the ACL back to allow remote service start stop with the following command.
It is wrapped here but should be entered as a single command:
sc sdset SCMANAGER D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
More info about 2003 SP1 ACL change and where that SDDL came from
Hotfix if subinacl produces Error 1783
You will probably need a different SCMANAGER SDDL for 2008 R1/R2 servers.