JSI Tip 6974. When you upgrade a Windows NT domain controller to Windows 2000, the Access Control List for the %SystemRoot%\System32\Wbem\MOF folder contains a S-1-5-32-547 entry?

The S-1-5-32-547 entry in the ACL of the %SystemRoot%\System32\Wbem\MOF folder represents the Power Users group, which does NOT exist on domain controllers.

You may safely remove the S-1-5-32-547 entry from the ACL of the MOF folder.