Remove-Service fails with Access is denied (PermissionDenied) even though the SID of the account that the PowerShell script runs under was added to the SDDL of the service when it was created:
$sddl = "D:(A;;0xF01FF;;;S-1-1-11-1111111111-222222222-333333333-444444)(...original SDDL...)"
New-Service -SecurityDescriptorSddl $sddl ...
S-1-1-11-1111111111-222222222-333333333-444444 is the SID of the account that the PowerShell Remove-Service runs under.
I expected that the account is allowed to delete the service when SDDL contains DACL with SERVICE_ALL_ACCESS (0xF01FF) as SERVICE_ALL_ACCESS includes STANDARD_RIGHTS_REQUIRED that contains DELETE.