JSI Tip 7731. You cannot use the new Windows Server 2003 well-known security principals?

When you promote a Windows Server 2003 computer to a domain controller, the Local Service, and other well-known security principals, do not appear, and cannot be used.

This behavior will occur when the forest root domain controller that holds the PDC emulator role is running Windows 2000 server.

NOTE: When the forest root domain controller that holds the PDC emulator role is running Windows 2000 server, the CN=WellKnown Security Principals,CN=Configuration,DC= container is not updated with the new well-known security principals.

To resolve this problem, update the PDC emulator to Windows Server 2003.

To workaround this problem, use SubInAcl to script the security on the well-known security principals:

subinacl /keyreg "" /grant="local service"=r

would grant the Local Service account Read permissions on the key.

Some of the well-known security principals that were introduced with Windows Server 2003 are:

Digest AuthenticationLocal ServiceNetwork ServiceNTLM AuthenticationOther OrganizationRemote Interactive LogonSChannel AuthenticationThis Organization

NOTE: See Another way to locate a FSMO role holder.

NOTE: See How do I upgrade Windows 2000 domain controllers to Windows Server 2003 and how to add new Windows Server 2003 domain controllers to Windows 2000 domains?