[Samba] guest share not working (for Disabled accounts)

[Rex Dieter]

I'm in an AD environment, with a samba server a member of the domain, 
and I'm trying to create a guest-level/read-only share accesssible by 
*anyone*.  The purpose of this share is a network distribution point for 
.msi package deployment via AD Group Policy.  My relevant smb.conf bits are:

[global]
   guest account = nobody
   map to guest = Bad User

[deploy]
   [msi]
   comment = Software Deployment
   path = /foo/deploy
   force user = nobody
   read only = yes
   browseable = no
   guest ok = yes
   guest only = yes

Now, I can access this \\server\deploy share from almost anywhere logged 
in as almost anyone, *except* if I'm logged in as local\Administrator. 
Unforatunately, it appears that when local machine try to use the share 
for software deployment, they are also accessing it as the local 
Administrator account.  I believe the root cause of failure is that the 
domain\Administrator account in our AD is either disabled or locked-out 
(and I don't have the rights to modify that global account as a lowly OU 
Admin).

Any ideas on how to grant access to this share to client machines for 
Group Policy software deployment purposes?

-- Rex