When you install CRM using “network service” account instead of the domain account, you may have a security error indicates that some roles need to be added to the user account.
Microsoft has a KB article about it: http://support.microsoft.com/kb/921393
It basically sets the service principal account.