I think I may have found it. In the service itself, the automatically created ServiceProcessInstaller component has a property "Account" which can be set to "LocalService", "LocalSystem", "NetworkService" or "User". It was defaulting to "User" which must have displayed the prompt.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…