The question is rather vague, or at least to me it is.

You state you had new user accounts 'appear' when you migrated, but then state that 'they can only SELECT and can't write to the database like they used to in 2000'. Did these same user accounts exist in the 2000 instance or did they appear only after creating 2008? Were they created by someone or did they literally just appear, like the service users typically do (such as DOMAINNAME\NTAUTHORITY).

Also when you migrated over, did you create new domain controllers? If so, your user SIDs no longer match. Did you rename your domain? If so, your sql server users are still referenced by the old domain which means you want to script their permissions out by right clicking on them, script user as, create. Then change the user name to reference the new one. Make sure you then include this user in all the databases it needs access to.

If you did in fact create a new domain, make sure you update your internal SQL Server name to reference the new Fully Qualified Host Name: http://blogs.msdn.com/b/cindygross/archive/2010/02/11/how-to-rename-sql-server.aspx

There's a lot of unknowns, please further clarify. Thanks!

The question is rather vague, or at least to me it is.

You state you had new user accounts 'appear' when you migrated, but then state that 'they can only SELECT and can't write to the database like they used to in 2000'. Did these same user accounts exist in the 2000 instance or did they appear only after creating 2008? Were they created by someone or did they literally just appear, like the service users typically do (such as DOMAINNAME\NTAUTHORITY).

Also when you migrated over, did you create new domain controllers? If so, your user SIDs no longer match. Did you rename your domain? If so, your sql server users are still referenced by the old domain which means you want to script their permissions out by right clicking on them, script user as, create. Then change the user name to reference the new one. Make sure you then include this user in all the databases it needs access to.

If you did in fact create a new domain, make sure you update your internal SQL Server name to reference the new Fully Qualified Host Name: Link

There's a lot of unknowns, please further clarify. Thanks!