For what it's worth, it would help to do the same when launching services.exe from wineboot. At the moment (ultimately via e92ba2de43d7afbe0704b11b29f7c30f44dfaeca), it gets a limited token, which all services inherit. Some services (GOG again) get quite upset if they don't have an admin token.