"net ads testjoin" now fails with the very same error. Although "net ads join" now works with allow_weak_crypto=true in /etc/krb5.conf. It looks like the internal used Kerberos from "net" does not read the system krb5.conf or did not support RC4 at all as /usr/share/doc/libkrb5-3/NEWS.Debian.gz only mentioned DES, not RC4 (which is my only possibility against Windows 2003 then).
# net ads testjoin [2010/01/26 11:42:26, 0] libads/sasl.c:819(ads_sasl_spnego_bind) kinit succeeded but ads_sasl_spnego_krb5_bind failed: Program lacks support for encryption type [2010/01/26 11:42:26, 0] libads/sasl.c:819(ads_sasl_spnego_bind) kinit succeeded but ads_sasl_spnego_krb5_bind failed: Program lacks support for encryption type Join to domain is not valid: Undetermined error
