When the Windows Service feature sets up a user, it should be possible to automatically grant the "log on as a service" rights in the local security policy.

Or, we should make a library step template that grants this which people can use/modify.