[Samba] can't join workstations to domain

[Hannu Tikka]

I have samba 3.0alpha24 server with LDAP as PDC.
I can use shares on the server, but I can't join workstation to domain
Error message is: Access denied.

and in log file with debug = 3 i found in logfile:
rpc_server/srv_samr_nt.c:access_check_samr_function(115)
  _samr_create_user: ACCESS DENIED (granted: 0x00000201;  required: 
0x00000010)

workstation account exists and is enabled:

uid: taivas$
objectClass: sambaSamAccount
displayName: konetunnus
objectClass: account
sambaAcctFlags: [U          ]
sambaPrimaryGroupSID: [domain sid]-1601
sambaSID [domain sid]-11000
sambaNTPassword 90568306802UYIEUYIUEIYUI
sambaLMPassword 5734767389767GERJGJGJDG
sambaPwdMustChange 1056456117
sambaPwdCanChange 1054641717
sambaPwdLastSet 1054641717

I have Administrator account set and group mappings should be ok, but i 
doubt the problem is somwhere there:

objectClass: sambaGroupMapping
objectClass: posixGroup
displayName: admins
sambaSID: [domain sid]-512
cn: Domain Admins
memberUid: Administrator
gidNumber: 301
sambaGroupType: 2

net groupmap list shows:
nobody (S-1-5-32-546) -> nobody
users ([domain sid]-513) -> smbusr
admins ([domain sid]--512) -> domadm
sysadmins ([domain sid]--1002) -> sysadm

I have made workstation account manually with smbpasswd and there is no 
workstation creation script set in smb.conf.
Any ideas what I'm missing?

regards
Hannu