Group policy preventing write access to hard drive for Windows Service

Question

I recently stood up several SharePoint Servers which use various domain user accounts as service accounts. Everything was going fine until the servers were moved from the staging OU to the production OU which has a server hardening GPO applied to it. Once
this occurred, all of SharePoint's logging via the Tracing service broke--because this account doesn't run as Local Service, but rather one of the domain user accounts.
After examining the Application event log, I saw it filled with errors indicating the E:\Logs\ULS and E:\Logs\Usage were not accessible due to error 0x5 -- access denied.
I explicitly granted permissions to the service account to these folders, and gave Full Control perms. I then restarted the service, but the Access Denied errors persisted. I granted Full Control to the entire E: drive -- the root folder -- with inheritance,
and made sure the permissions were inherited. And yet the problem persisted.
I installed a different application which can log to different drives, and it writes to the E: drive just fine when run as Local System. If I change it to one of the domain service accounts, it too produces Access Denied errors trying to write to the E:
drive, regardless of the NTFS perms.
The E: drive is a hard drive, not a USB or removable drive.
I found several posts here that explain how to disable write access to USB and DVD media, but I cannot find anything how to block writing to a hard drive. The server hardening GPO contains thousands of different settings and it'll take days to comb through
them all. Does anyone know of a GPO setting that can block writing to a hard drive, regardless of NTFS perms?
The servers in question are running Windows Server 2012 standard (not R2).
UPDATE: If I grant the service account the ability to log on locally (i.e. add it to the local Users group), and open a command prompt with "Run as User," I can write to the E: drive just fine. But the access denied
persists when running as a service. This leads me to believe a GPO is blocking the write access to a
service user but allowing the same account when logging in as an interactive
user.

Answer 1

I created a test Windows service that does nothing more than open two StreamWriter objects -- one to write into E:\Logs\ULS and the other into C:\ProgramData\Logs. The former writes dummy text once per second, while the latter writes errors. So error messages
will get written into C:\ProgramData\Logs.
I set up this test Windows Service and set it up to use my SharePoint app pool account, and this was written to the error log - the first line indicates the account being used.
[8/22/2014 12:01:25 PM] - Error writer is initialized and ready. Execution context svc_SPSvcApp_J
[8/22/2014 12:01:25 PM] - Directory E:\Logs\ULS does not exist.
[8/22/2014 12:01:25 PM] - Failed to set up the log writer. Access to the path 'E:\Logs\ULS' is denied.
System.UnauthorizedAccessException: Access to the path 'E:\Logs\ULS' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)
at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)
at ServiceLogWriter.Service1.Compose()
I then tried this with my Farm account. For TEST purposes, I TEMPORARILY put this account in the local Administrators group (I removed it after the test). And
STILL does not see the E: drive or any folders it contains.
[8/22/2014 12:05:08 PM] - Error writer is initialized and ready. Execution context svc_SPFarm_J
[8/22/2014 12:05:08 PM] - Quick test to look for things we KNOW exist on the Server. We know there is an E: drive, and we know there's a folder named E:\Logs\ULS.
[8/22/2014 12:05:08 PM] - Windows reports E:\ does not exist. This is bad.
[8/22/2014 12:05:08 PM] - Windows reports E:\Logs does not exist. This is very bad.
[8/22/2014 12:05:08 PM] - Windows reports E:\Logs\ULS does not exist. In the words of the late Captain Phil Harris, "This is bad. This is bad bad."
[8/22/2014 12:05:08 PM] - Directory E:\Logs\ULS does not exist (we'll try to create it).
[8/22/2014 12:05:08 PM] - Failed to set up the log writer. Access to the path 'E:\Logs\ULS' is denied.
System.UnauthorizedAccessException: Access to the path 'E:\Logs\ULS' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)
at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)
at ServiceLogWriter.Service1.Compose()
Next I tried my own ID to run the same service. I'm a Domain Admin so I should have ruler of the roost perms 
[8/22/2014 12:12:35 PM] - Error writer is initialized and ready. Execution context sawyemat
[8/22/2014 12:12:35 PM] - Quick test to look for things we KNOW exist on the Server. We know there is an E: drive, and we know there's a folder named E:\Logs\ULS.
[8/22/2014 12:12:35 PM] - Windows reports E:\ does not exist. This is bad.
[8/22/2014 12:12:35 PM] - Windows reports E:\Logs does not exist. This is very bad.
[8/22/2014 12:12:35 PM] - Windows reports E:\Logs\ULS does not exist. In the words of the late Captain Phil Harris, "This is bad. This is bad bad."
[8/22/2014 12:12:35 PM] - Directory E:\Logs\ULS does not exist (we'll try to create it).
[8/22/2014 12:12:35 PM] - Failed to set up the log writer. Access to the path 'E:\Logs\ULS' is denied.
System.UnauthorizedAccessException: Access to the path 'E:\Logs\ULS' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)
at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)
at ServiceLogWriter.Service1.Compose()
Mind you I'm starting and stopping the service while logged in interactively -- I can CLEARLY SEE there's an E: drive and E:\Logs\ULS folder!
It is quite evident to me that there is a policy blocking Windows services from seeing the E:
drive.
Run this under the LocalSystem (SYSTEM) account, and all is well.
[8/22/2014 12:15:18 PM] - Error writer is initialized and ready. Execution context SYSTEM
[8/22/2014 12:15:18 PM] - Quick test to look for things we KNOW exist on the Server. We know there is an E: drive, and we know there's a folder named E:\Logs\ULS.
[8/22/2014 12:15:18 PM] - So far so good - Windows reports E:\ exists.
[8/22/2014 12:15:18 PM] - Windows reports E:\Logs exists.
[8/22/2014 12:15:18 PM] - Awesome - Windows reports E:\Logs\ULS exists.
[8/22/2014 12:15:18 PM] - Log writer is set up successfully.
[8/22/2014 12:15:25 PM] - Shutdown in progress.