How to reset service permissions after messing up with `sc sdset`?
The SYSTEM security context can reset it. You don't mention your Windows version, but in Windows Server 2008 and newer versions it can be a bit difficult to get a SYSTEM command prompt. It's very easy, though, to get the "Task Scheduler" in all versions of Windows to run a command as SYSTEM.
Dump the security descriptor from a known-good machine using the
sc sdshow spoolercommand.
Create a scheduled task on the broken machine to run the command
%SystemRoot%\system32\sc.exewith the arguments
sdset spoooler <paste good security descriptor here>.
Set the task to run as SYSTEM
Manually run the task
Your service's security descriptor will be restored to normal.