The user profile that runs the ITP/Server NT Services needs to have the rights to log on as a service. The Log on as a Service right can be assigned to a user profile through the Local or Domain Security settings in Microsoft Windows.

This privilege can be either assigned directly to a user profile or to a group where it will transfer to the group's members.
Make sure that the assigned right does not conflict with the Deny login as a service setting.