[Samba] Minimum Permissions Required to Associate to a Windows Server 2003 AD Realm

[Tavis]

I'm setting up a windows server 2003 ADS Realm with a few samba servers 
associating to it, however i've found that the accounts on the DC that i 
use to associate samba with need to be in the administrator group 
otherwise the association fails. ("ads_join_realm: Insufficient access")

I'm just curious what the absolute minimum privileges are on the Windows 
Server 2003 DC to allow the Samba server to Join the ADS Realm? I don't 
like the idea of giving the accounts used by samba administrative 
access, and it just doesn't seem necessary.