Remote Windows Service Administration using SC produces OpenService FAILED 5: error

Attempting to administer a Windows Service on a remote computer using the SC command may produce an unexpected error

[SC] OpenService FAILED 5:

Access is denied.


This can occur where a remote command window has been created using PSEXEC and SC commands are issued to control or query a Windows Service e.g.

sc query "Target Windows Service Name"


The cause is the original permissioning of the service during installation uses SSDL text strings which denies access to "over the network" admin attempts.

An example of such a SSDL string is:
D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;NU)

Check the MsiLockPermissionsEx Table of the MSI responsible for installation to verify the SSDL string presence.

Administering the service can properly be carried out via a locally logged on (or over RDP) session at the target computer.

This situation was discovered from this post
https://serverfault.com/questions/762824/remote-service-query-sc-exe-query-fails-with-access-is-denied-for-one-servic