JSI Tip 7731. You cannot use the new Windows Server 2003 well-known security principals?

When you promote a Windows Server 2003 computer to a domain controller, the Local Service, and other well-known security principals, do not appear, and cannot be used.

This behavior will occur when the forest root domain controller that holds the PDC emulator role is running Windows 2000 server.

NOTE: When the forest root domain controller that holds the PDC emulator role is running Windows 2000 server, the CN=WellKnown Security Principals,CN=Configuration,DC=<Your Domain> container is not updated with the new well-known security principals.

To resolve this problem, update the PDC emulator to Windows Server 2003.

To workaround this problem, use SubInAcl to script the security on the well-known security principals:

subinacl /keyreg "<Registry Key>" /grant="local service"=r

would grant the Local Service account Read permissions on the <Registry Key> key.

Some of the well-known security principals that were introduced with Windows Server 2003 are:

Digest Authentication
Local Service
Network Service
NTLM Authentication
Other Organization
Remote Interactive Logon
SChannel Authentication
This Organization

NOTE: See Another way to locate a FSMO role holder.

NOTE: See How do I upgrade Windows 2000 domain controllers to Windows Server 2003 and how to add new Windows Server 2003 domain controllers to Windows 2000 domains?