I'm getting "Access Denied" from domain accounts that have been granted the permission to join a specific computer account to the domain.
It seems to work ok in our testing lab, but not in production.
When we create the computer account, we are selecting a non-privileged account under the "User or group that can join the computer to domain" option.
There is no error during the computer account creation, but the attribute "adm-UserOrGroupThatCanJoinComputerToDomain" is not being set either. Not sure this is supposed to be visible or not....