You probably call OpenSCManagerby specifying a flag SC_MANAGER_ALL_ACCESSthat actually requires a set of privileges that are set by default only for administrators. To start / stop services, you just need to specify the flag SC_MANAGER_CONNECT, which by default is provided to any authenticated user.
Now that you have the descriptor of the service manager, you must use OpenServiceto get the descriptor of this service. To have the right to start / stop the service, you must specify GENERIC_READ | GENERIC_EXECUTEas the necessary access (in fact, I think you can even narrow down the necessary rights only to SERVICE_STARTand SERVICE_STOPand, if necessary SERVICE_INTERROGATE).
: DACL , DACL , , / ; . . . .
/ , , , DACL, , , .
, , (, LocalSystem) , , - . / , , .
, / ?