It's the Access Control List for the service object. You can view the ACL for a service using the sc tool:
C:\>sc sdshow w3svc
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)
(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)
(A;;CCLCSWLOCRRC;;;AU)
(A;;CCLCSWRPWPDTLOCRRC;;;PU)
This output is in Security Descriptor Definition Language [SDDL] format. To set the ACL on a service from code, use SetServiceObjectSecurity. From the command line, you can use sc sdset. Stability. What an interesting concept. -- Chris Maunder