The dreaded WID error installing WSUS

OK, so I'm getting the same error I've seen in multiple posts about the WID install failing when trying to install WSUS.  I've tried this fix but it didn't work:

1.       Open up your domain group policy editor.
2.       Navigate to the Default Domain Policy
3.       Navigate to Policies -> Windows Settings -> Security Settings -> Local Policy -> User Rights Assignment
4.       Find the “Log on as a service” policy and edit it.
5.       Click on “Add user or group” button.
6.       Add the following users: NETWORK, NETWORK SERVICE, SERVICE
7.       Got to your Server 2012 machine and open an elevated command prompt.
8.       Type in: gpupdate /force. Wait for it to successfully complete
9.       Now try and install the WID .You should now have successfully completed the installation.

I also added IIS_WPG and NT SERVICE\ALL SERVICES

I've also tried making Log on as a service "Not Define" and then going to secpol.msc > Local Policies > User Rights Assignment > Log on as a service and adding all of the above, but it's grayed out and I can't modify it.

The machine I'm working on is a Windows Server r2 installation.  It's setup for AD DS, DNS, and NAP, but is not the primary for any of these.  I always get the same error message:

The MSSQL$MICROSOFT##WID service was unable to log on as NT SERVICE\MSSQL$MICROSOFT##WID with the currently configured password due to the following error:
Logon failure: the user has not been granted the requested logon type at this computer.
Service: MSSQL$MICROSOFT##WID
Domain and account: NT SERVICE\MSSQL$MICROSOFT##WID
This service account does not have the required user right "Log on as a service."
User Action
Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.