Check quoted and unquoted service paths
windowschecklist
Walkthrough
Find service paths with spaces that are not wrapped in quotes. A writable directory along an unquoted path lets you drop a binary that runs as the service account.
Commands
cmd
wmic service get name,pathname | findstr /i /v "C:\Windows\" | findstr /i /v """