[Samba] Do you have to join a domain to use 'net ads search'?

[pisymbol .]

Folks:

I have a somewhat naive question, the 'net ads search' tool seems to be a
wrapper, or at least in the same vain, for what the 'ldapsearch' tool
does...do you have to join a machine to AD to use it?

But I noticed that at on my companies network, I was able to perform
searches on a fresh box that had Samba/Kerberos config files setup, but not
joined. I simply passed the AD creds ('user at domain%password) for each
query. Everything seemed to work.

Is this generally true across all AD installs? Joining is not required for
querying? Are their any restrictions mandated on a per machine basis that
would prevent various queries from executing on the DC? Is it different if
the DC is running Samba vs a native Windows server?

Any insight into this would be very much appreciated (or even pointers),

-aps