Microsoft Windows has an issue where you can use the CreateProcessWithLogon API to escape a write restricted service and achieve full write access as the service user.
Microsoft Windows CreateProcessWithLogon Write Restricted Service Privilege Escalation
