The domain account (a slightly-reduced privilege account for managing servers) we're installing with is a member of the administrators group on the machine, but doesn't seem to have exactly the same group policy as the domain administrators, because when installing a database with dbca (specifically, when attempting to set up the services), we get:
Cannot open the Windows NT Service Control Manager
O/S-Error: (OS 5) Access is denied.
This error is identical to that from oradim -new -sid DATABASENAME
DIM-00014: Cannot open the Windows NT Service Control Manager.
O/S-Error: (OS 5) Access is denied.
We noticed that going into the services control panel with this user gives a warning, which you can continue from and then start and stop services just fine. The same user on a Windows Server 2003 (should be same group policy) does not get any warning going into the services.
The domain administrators do not see such a warning when entering the services control panel, and they are also able to get past this error when running dbca.
Is there a specific permission which has changed with Windows Server 2008 which we need to add to our group policy or something?
Running the installer with escalated permissions should do the trick - Right-click and "Run As Administrator", or set to run as admin in the Properties window under the Compatibility tab.
If this doesn't work, then it may be spinning off a separate process that is losing the permission escalation; in that case, you'll want to just disable UAC temporarily (Control Panel -> User Accounts -> Change User Account Control settings).