This is quite a strange situation I've seen when applying SP2 or hotfix to a SQL2005 cluster, reviewing the Summary.txt file the failure is something like this...

----------------------------------------------------------------------------------
Product                   : Database Services (INST2)
Product Version (Previous): 1399
Product Version (Final)   :
Status                    : Failure
Log File                  : C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\LOG\Hotfix\SQL9_Hotfix_KB921896_sqlrun_sql.msp.log
Error Number              : 29512
Error Description         : MSP Error: 29512  SQL Server Setup was unable add user Administrator@W2K3LAB.com to local group W2K3LAB\Domain Admins.
----------------------------------------------------------------------------------

If we do as we are told and look in SQL9_Hotfix_KB921896_sqlrun_sql.msp.log we see the following

<Func Name='LaunchFunction'>
Function=Do_sqlGroupMember
<Func Name='GetCAContext'>
<EndFunc Name='GetCAContext' Return='T' GetLastError='0'>
Doing Action: Do_sqlGroupMember
PerfTime Start: Do_sqlGroupMember : Thu Nov 27 17:04:08 2008
<Func Name='Do_sqlGroupMember'>
Local group W2K3LAB\Domain Admins doesn't exist
Failure adding user Administrator@W2K3LAB.com to local group W2K3LAB\Domain Admins (2221)
        Error Code: 0x800708ad (2221)
Windows Error Text: The user name could not be found.
  Source File Name: sqlca\sqlsecurityca.cpp
Compiler Timestamp: Wed Jun 14 16:27:11 2006
 

Now I should point out that on my test system here the groups I specified for the SQL services during setup were all Domain Admins so you are probably not going to be quite that lazy on a production server :-)

The significant thing here is to notice the format of the user we are trying to add rather than the usual format w2k3lab\administrator we are seeing Administrator@w2k3lab.com

This is a relativly easy one to sort out by simply changing the adminstrator account back to w2k3lab\administrator and re-running setup. I'd recommend using  SQL Server Configuration Manager to make this change. I found that Configuration Manager didn't actually validate accounts correctly if they were in the wrong format, reporting a password failure, I was only able to set the account to the 'bad' format using  Services.