Bitbucket as Windows Service won't Start without atlbitbucket User in Admin group

Question

I have Bitbucket 5.01 on a Windows 2012 R2 server.  Used Atlassian installer so service has a local atlbitbucket account as the service account.  I had to add it to the Administrators group or the service will not start.  Performance is very slow and saw on web that removing account from administrators group will speed up performance but then service does not start.

Anyone have the recipe for getting the service to work correctly on Windows Server 2012 and not have the account in the admin group?

UPDATE: I followed the instructions here

https://confluence.atlassian.com/bitbucketserver/running-bitbucket-server-with-a-dedicated-user-776640047.html

and set the folder access for atlbitbucket user but the service would still not start once I removed altbitbucket from the Windows admin group.  I am clear about where the home directory is, in fact privilege for it was already set correctly.  The "install" directory seemed straightforward but I wonder if I got it right.  There are version specific directories under a root Atlassian directory.  Are these the "install" directories?

UPDATE #2: The error in the event log when starting the service with atlbitbucket user not in the Administrator group

Faulting application name: bserv64.exe, version: 1.0.15.0, time stamp: 0x51543b9d

Faulting module name: jvm.dll, version: 25.71.0.1, time stamp: 0x576af213

Exception code: 0xc0000005

Fault offset: 0x0000000000216aa8

Faulting process id: 0x1354

Faulting application start time: 0x01d32f0e943af960

Faulting application path: C:\Atlassian\Bitbucket\5.0.1\bin\bserv64.exe

Faulting module path: c:\atlassian\bitbucket\4.13.0\jre\bin\server\jvm.dll

Dave Theodore [Coyote Creek Consulting] · Answer

You need to make sure all files in the installation and home directories are owned by the user that the service runs as.  You shouldn't need to change any file permissions.

Ken Fischer · Answer

Dave,

The problem is with a file access at service startup.  Not sure if your answer addresses this failure.  I agree about running from account not in admin group. Trying to use Atlassian account if possible to make updates easier.

Dave Theodore [Coyote Creek Consulting] · Answer

I would advise having it run as an unprivileged user and binding to 7990/7999 as the out of the box configuration. This is best from a security perspective. Use Apache, IIS, etc to reverse proxy to it and have that listen on 80/443. This will eliminate the need to run as part of the administrators group.