Local Service and other well-known security principals do not appear on your Windows Server 2003 domain controller

After you run the dcpromo.exe command on a Microsoft Windows Server 2003 computer to promote the server to a domain controller, the Local Service and other well-known security principals that are introduced with Windows Server 2003 do not appear. You cannot resolve the well-known security principals when you try to add the well-known accounts by using NTFS file system permissions on a file or a folder. Additionally, you cannot resolve the well-known security principals when you use the ADSI Edit tool, the Group Policy Object Editor snap-in (Gpedit.msc), or Registry Editor. Also, if you use the ADSI Edit tool or the LDP tool (Ldp.exe), the well-known accounts do not appear in the following container:

This behavior occurs when the forest root domain controller that holds the primary domain controller (PDC) emulator operations master role is running Microsoft Windows 2000 Server. If the forest root PDC emulator operations master is running Windows 2000, the CN=WellKnown Security Principals,CN=Configuration,DC=YourDomain container is not updated with the well-known security principals that are introduced in Windows Server 2003. Therefore, the Object Picker cannot find and resolve the corresponding names. The Object Picker queries the WellKnown Security Principals container to find the list of well-known security principals.

To resolve this behavior, upgrade the forest root PDC emulator operations master role holder to Windows Server 2003.

WORKAROUND

You may experience the behavior that is described in the "Symptoms" section with one or more of the following well-known security principals that are introduced in Windows Server 2003:

• Digest Authentication
• Local Service
• Network Service
• NTLM Authentication
• Other Organization
• Remote Interactive Logon
• SChannel Authentication
• This Organization

For additional information about how to determine what domain controller holds the PDC emulator FSMO role, click the following article number to view the article in the Microsoft Knowledge Base: For additional information about FSMO roles, click the following article number to view the article in the Microsoft Knowledge Base: For additional information about how to upgrade a Windows 2000 domain controller, click the following article number to view the article in the Microsoft Knowledge Base: