Securing Critical and Service Accounts

The service administrator groups and accounts listed in the preceding table are protected by a background process that periodically checks and applies a specific security descriptor that contains security information associated with that protected object.

msdn.microsoft.com