How to reset service permissions after messing up with `sc sdset`?

The SYSTEM security context can reset it. You don't mention your Windows version, but in Windows Server 2008 and newer versions it can be a bit difficult to get a SYSTEM command prompt. It's very easy, though, to get the "Task Scheduler" in all versions of Windows to run a command as SYSTEM.

• Dump the security descriptor from a known-good machine using the sc sdshow spooler command.

• Create a scheduled task on the broken machine to run the command %SystemRoot%\system32\sc.exe with the arguments sdset spoooler <paste good security descriptor here>.

• Set the task to run as SYSTEM

• Manually run the task

Your service's security descriptor will be restored to normal.