Work Around: Am able to prevent TS from running via LGPO & a Registry tweak. For the latter, go to HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server & change the TSEnabled REG_DWORD value from 1 to 0. Would still like to know why I can't disable the service using the Services console.