I ran into the same issue on Windows 2003. Make sure that in your local security policy, you set the "Local Policies\User Rights Assignment\Act as part of the operating system" with the same username that is running the ACS services. That fixed my...