The subject behavior occurs because the Local Service account is NOT granted Read permission on HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Cryptography/Calais/Current and HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurePipeServers/winreg.
NOTE: If you run Spdwnw2k.exe from the Windows 2000 SP4 CD prior to the upgrade, the problem will be averted.
NOTE: The subject problem doesn't happen unless you upgrade Windows 2000 SP4, or later. It also doesn't happen if you upgrade to a slipstreamed Windows XP SP2.
To workaround this problem, grant the Local Service account Read permissions on the above registry keys.