Service question card
Label: original fictional Windows card. No service was started and no permission was changed.

Host name on the card: files-3.lab.invalid. It was not contacted.
Service: NightIndex
Started by: the Service Control Manager, the Windows component that tracks installed services.
Runs as: LocalSystem, a highly privileged local identity on this card.
Program configured: C:\lab\night-index\run.bat

Question, not a procedure: who can write run.bat, and who is the service running as?
If an ordinary account can rewrite the program a higher-rights service starts, the ordinary account can change what that service executes.
This card does not tell you to replace the file, restart the service, or collect a credential.

sudo note, different operating system: the sudo manual says not to grant sudo the right to execute a file the user can write, or a file in a directory the user can write. Same shape. This activity uses the Windows rows.