Test the permissions for the service executables and directories.

Get-ServicesExePerms.ps1

########################
# Get-ServicesExePerms.ps1: Test the permissions for the service executables and directories.
# Author: Don C. Weber (cutaway)
# Date:   20240723
#
########################

$sf = (Get-CimInstance -ClassName Win32_Service).PathName | ForEach-Object { ( ( ( $_ -Split '.exe' )[0] -replace '^"') + '.exe' ).tolower() } | Sort-Object | Get-Unique | ForEach-Object { if ( Test-Path -Path "$_" -PathType Leaf ) { $_ } }

#$rights = @("FullControl","Modify","Write","Read","ReadAndExecute","Synchronize")
#$rights = @("ReadAndExecute")
$rights = @("Full Control","Modify","Write")

$Output = @()

Write-Output "###########################"
Write-Output "Chcking permissions on the executable"
Write-Output "###########################"
ForEach ($f in $sf) {
    $Acl = Get-Acl -Path "$f"
	
    #$Acl = Get-Acl -Path (Split-Path -Parent "$f")
    #ForEach ($Access in $Acl.Access) {
    #ForEach ($Access in ($Acl.Access | Where-Object { ($_.IdentityReference -eq "BUILTIN\Users" -and ($_.FileSystemRights) -match "Modify") })) {
    #ForEach ($Access in ($Acl.Access | Where-Object { ($rights | ?{ $_.FileSystemRights -notcontains $_ } )} )) {
    #ForEach ($Access in ($Acl.Access | Where-Object { (($_.FileSystemRights) -contains $rights)})) {
		
	
    ForEach ($Access in $Acl.Access){
		$frights = @($Access.FileSystemRights -Split ',')
		$check = Compare-Object -ReferenceObject $rights -DifferenceObject $frights -IncludeEqual -ExcludeDifferent
		if ($check) {
			$Properties = [ordered]@{'Folder Name'=$f;'Group/User'=$Access.IdentityReference;'Permissions'=$Access.FileSystemRights;'Inherited'=$Access.IsInherited}
			$Output += New-Object -TypeName PSObject -Property $Properties         
		}
	}
}

$Output | Format-List -Property *

$Output2 = @()
Write-Output "###########################"
Write-Output "Chcking permissions on the executable parent directory"
Write-Output "###########################"
ForEach ($f in $sf) {
    #$Acl = Get-Acl -Path "$f"
	$Acl = Get-Acl -Path (Split-Path -Parent "$f")
    #ForEach ($Access in $Acl.Access) {
    #ForEach ($Access in ($Acl.Access | Where-Object { ($_.IdentityReference -eq "BUILTIN\Users" -and ($_.FileSystemRights) -match "Modify") })) {
    #ForEach ($Access in ($Acl.Access | Where-Object { ($rights | ?{ $_.FileSystemRights -notcontains $_ } )} )) {
    #ForEach ($Access in ($Acl.Access | Where-Object { (($_.FileSystemRights) -contains $rights)})) {
		
	
    ForEach ($Access in $Acl.Access){
		$frights = @($Access.FileSystemRights -Split ',')
		$check = Compare-Object -ReferenceObject $rights -DifferenceObject $frights -IncludeEqual -ExcludeDifferent
		if ($check -and($Access.IdentityReference -eq "BUILTIN\Users") ) {
			$Properties = [ordered]@{'Folder Name'=$f;'Group/User'=$Access.IdentityReference;'Permissions'=$Access.FileSystemRights;'Inherited'=$Access.IsInherited}
			$Output2 += New-Object -TypeName PSObject -Property $Properties         
		}
	}
}

$Output2 | Format-List -Property *