https://support.microsoft.com/en-us/kb/2914651

To resolve this issue, follow these steps to add the service accounts that are mentioned in Event ID 7041 (that is, DOMAIN\ServerAdmin$ and DOMAIN\MediaAdmin$) to the "Log on as a Service" Group Policy setting.

1. Start Group Policy Management Console (GPMC). To do this, take one of the following actions: Press the Windows logo key + R to open the RUN dialog box, type gpmc.msc in the text box, and then click OK or press Enter. Or, click Start, click in the Start Search box, type gpmc.msc, and then press Enter.
2. Right-click Default Domain Controllers Policy, and then click Edit.
3. Browse to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment.
4. In the details pane, double-click Log on as a service.
5. Make sure that the Define these policy settings check box is selected, and then click Add User or Group.
6. Type the name of the service account that is mentioned in Event ID 7041 For example, type DOMAIN\ServerAdmin$ or DOMAIN\MediaAdmin$. Or, click Browse to locate the account with the Select Users, Computers, or Groups dialog box, and then click OK.
7. After you have the account name entered, click OK in the Add User or Group dialog box, and then click OK in the Allow log on locally Properties dialog box.
8. To update the modified Group Policy manually, at command prompt, type gpupdate, and then press Enter.
9. Rerun the Post-Deployment Configuration task.