When you promote a Windows Server 2003 computer to a domain controller, the Local Service, and other well-known security principals, do not appear, and cannot be used.
This behavior will occur when the forest root domain controller that holds the PDC emulator role is running Windows 2000 server.
NOTE: When the forest root domain controller that holds the PDC emulator role is running Windows 2000 server, the CN=WellKnown Security Principals,CN=Configuration,DC=<Your Domain> container is not updated with the new well-known security principals.
To resolve this problem, update the PDC emulator to Windows Server 2003.
To workaround this problem, use SubInAcl to script the security on the well-known security principals:
subinacl /keyreg "<Registry Key>" /grant="local service"=r
would grant the Local Service account Read permissions on the <Registry Key> key.
Some of the well-known security principals that were introduced with Windows Server 2003 are:
Digest Authentication Local Service Network Service NTLM Authentication Other Organization Remote Interactive Logon SChannel Authentication This OrganizationNOTE: See Another way to locate a FSMO role holder.