For the Service Account to run both IIS and the Server & Reporter services, it needs to be part of two Local Security Policies:
- Log on as Batch Job
- Log on as Service
If your GPO has anything configured for these, it will overwrite any local setting, preventing the Service Account from properly running IIS and the required services.