2008 sets incorrect security on systemroot on DCs in root domain

i'm having consistent problem attempts upgrade dcs of root domain server 2008. dcpromo setting incorrect acls way down windows folder on server 2008 try promote, and any existing 2003 dc upgraded 2008 ends same way.

for example on system32 get:

authenticated users    read & execute    this folder, subfolders , files
server operators        modify                    this folder, subfolders , files
administrators             full control            this folder, subfolders , files
system                        full control            this folder, subfolders , files
trustedinstaller           special                   this folder only
creator owner        special                    subfolders , files only

whereas should be:

trustedinstaller            special                    this folder , subfolders
system                        special                    this folder only
system                        special                    subfolders , files only
administrators               special                    this folder only
administrators                special                    subfolders , files only
users                            read & execute        this folder, subfolders , files
creator owner            special                    subfolders , files only

which before dcpromo on clean installation.

most folders, not all, beneath inheriting, when shouldn't be.

this stopping services starting - annoyingly event viewer service doesn't have permission on winevt folder (server operators do). permissions cryptography service, diagnostic policy service, network service , whole list of others missing appropriate folders.

this has happened 32-bit , 64-bit upgrades of existing windows server 2003 r2 sp2 dcs , clean build of server 2008 dcpromoed. in case of clean build acls correct before dcpromo , wrong afterwards.

the root domain windows server 2003 native. there haven't been windows 2000s years.

forestprep , domainprep went without error. schema object version 44 (correct server 2008).

it not seem related fsmo role.

what i'm getting looks strange mix of server 2003 , server 2008 acls.

however, 2 child domains have had domain controllers upgraded without problem. acls correct. happening in root.

on 1 occasion tried obscenely long manual edit, resetting acls in comparison 1 of successful dcs in 1 of child domains. sadly reset old acls within few hours.

so, can tell me how happening? original default dc ace setting list used dcpromo kept? weird list of aces coming from? why can't rid of it? why in 1 domain?

answer own question: ntfs settings coming default domain controllers policy of root domain. 6 years ago, microsoft default domain controllers security template applied fix problem caused tool messed file system permissions of domain controller. 6 years later along comes windows server 2008 new set of permissions...

which means used either microsoft's default security templates or high security templates domain controllers (both seems withdrawn) needs clear them out before windows server 2008 upgrade.

Windows Server  >  Directory Services