Since InstallUtil will refuse to install encrypted .NET service application installation or un-installation process has to be done directly from service.

1. Include reference to: System.Configuration.Install namespace.

2. Main entry should look like this:

        /// <summary>
        /// The main entry point for .NET service application
        /// </summary>
        static void Main(string[] args)
        {
            if (args.Length > 0)
            {
                string path = System.Reflection.Assembly.GetExecutingAssembly().Location;
                string[] commandLine;

                switch (args[0].ToUpper())
                {
                    case "-I":
                        commandLine = new string[] { path };
                        break;

                    case "-U":
                        commandLine = new string[] { "/u", path };
                        break;

                    default:
                        throw new ArgumentException("Invalid command line argument.");
                }

                // register/unregister service
                ManagedInstallerClass.InstallHelper(commandLine);
            }
            else
            {
                ServiceBase[] ServicesToRun;
                ServicesToRun = new ServiceBase[]
            {
                new Service1()
            };
                ServiceBase.Run(ServicesToRun);
            }
        }

3. Call service from command line to install (-i) or un-install it (-u).

NOTE: C# .NET Windows service protection sample project (VS 2019) is included in samples.