Windows 2000 domain controllers require SP3 or later when using Windows Server 2003 administration tools
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AdminDebug.
ADsOpenObjectFlags
Value Data (Hexadecimal)	Disables
1	Signing
2	Encryption
3	Encryption and Signing