Call the CreateService API to create a service object and add it to the service control manager (SCM) database.
Call the SetServiceObjectSecurity API to set the security descriptor of the service object created in step 1.
Call the ChangeServiceConfig2 API to mark the service as protected, specifying the new SERVICE_CONFIG_LAUNCH_PROTECTED enumeration value, which has been added in Winsvc.h (as of Windows 8.1).