Windows privileges (examples) are assigned to accounts and groups, and by default the "SERVICE" built-in principal has a couple of privileges assigned, such as the "impersonate user" privilege.
I want to create a restricted account for a service that doesn't have this privilege. Can I somehow set a "deny" rule for this privilege, just like one can use with file ACLs? Or do I have to remove "SERVICE" from the list of SeImpersonatePrivilege grantees to achieve this? (something I'd rather avoid if I can, since this can conceivably break other services)
Edited to correct a brain-cloud-induced conflation of two completely unrelated things into one monstrosity of a question.