One of the root cause behind this issue is the presence of NT SERVICE\MSSQLSERVER and NT SERVICE\SQLSERVERAGENT under Local Policies\User Rights Assignments \ Replace a process level Token

As it is said above running SQL server repair will register these accounts properly.