SQL Server Setup could not validate the service accounts

SQL 2005 Enterprise x86 onto a 2003 R2 Domain Controller. Using a
domain user account for the user. The domain user account has:
Act as part of the OS
Log on as a service
Log on as a batch job
Lock pages in memory
Replace a process level token
Bypass traverse checking
Adjust memory quotas for a process
Impersonate a client after authentication

but is not a member of any of the Administrator groups.

During setup stage "SQL Server Database Services" setup is failing with
the following error:

TITLE: Microsoft SQL Server 2005 Setup
------------------------------

SQL Server Setup could not validate the service accounts. Either the
service accounts have not been provided for all of the services being
installed, or the specified username or password is incorrect. For each
service, specify a valid username, password, and domain, or specify a
built-in system account.

For help, click:
http://go.microsoft.com/fwlink?LinkID=20476&ProdName=Microsoft+SQL+Serve
r&ProdVer=9.00.1399.06&EvtSrc=setup.rll&EvtID=28075&EvtType=sqlca%5cserv
icedlg.cpp%40Validate_ServiceAccounts%40ServiceAccountValidate%3a%3aVali
dateAccount%40x6dab

------------------------------
BUTTONS:

&Retry
Cancel
------------------------------

However, a quick perusal of the audit log makes clear that the username
and password are correct. The (woefully unhelpful) install log says:

MSI (s) (70!7C) [02:54:15:316]: Product: Microsoft SQL Server 2005 --
Error 28075. SQL Server Setup could not validate the service accounts.
Either the service accounts have not been provided for all of the
services being installed, or the specified username or password is
incorrect. For each service, specify a valid username, password, and
domain, or specify a built-in system account.
The logon account cannot be validated for the service SQL Browser.

Error 28075. SQL Server Setup could not validate the service accounts.
Either the service accounts have not been provided for all of the
services being installed, or the specified username or password is
incorrect. For each service, specify a valid username, password, and
domain, or specify a built-in system account.
The logon account cannot be validated for the service SQL Browser.
<Func Name='SetCAContext'>
<EndFunc Name='SetCAContext' Return='T' GetLastError='0'>
Doing Action: Validate_ServiceAccounts
PerfTime Start: Validate_ServiceAccounts : Mon Dec 19 02:54:15 2005
<Func Name='Validate_ServiceAccounts'>
<Func Name='GetServiceAccountProperty'>
Failed to validate service account DOMAIN-NAME\ACCOUNT-NAME
Error Code: 0x80076dab (28075)
Windows Error Text: Source File Name: sqlca\servicedlg.cpp
Compiler Timestamp: Mon Aug 29 01:18:40 2005
Function Name: ServiceAccountValidate::ValidateAccount
Source Line Number: 751



Error Code: 28075

It's clearly not happy about something, but I have no idea what. Any
ideas?
.