NT ADS Join from Samba 3.6.6+ to Windows Server 2008 ADS fails with ACCESS_DENIED?

[Richard Sharpe]

Hi folks,

We are seeing a Samba 3.6.6+ installation when trying to join a Server
2008 ADS domain fail with ACCESS DENIED.

We use 'net ads join' and see the following during the join process:

SPNEGO login failed: Access denied
failed session setup with NT_STATUS_ACCESS_DENIED

The command seems to only be prepared to use NTLMSSP rather than KRB5.

Is there some policy setting in ADS that enforces KRB5 authentication?
Can they require that the older RPCs not be used?

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)