[Samba] net ads join requires full domain admin account?

[Sean.Dougherty at TTUHSC.EDU]

Problem:  I have an account that allows me to join an AD domain, this works
fine from any win box.  However it fails with "ads_add_machine_acct
(client_name): Insufficient access" when I do a net ads join from a linux
box.  To get samba to join the domain, I have to use an account with full
domain admin privs. (ie net ads join -Ufull_domain_admin)  

 

Is this expected behavior?  

 

The linux box is running Fedora Core 3, samba 3.0.10-1, krb 1.3.6-2