The net -P option fails unless you're in an ADS environment due to using machine$@realm as the username. The attached patch against SAMBA_3_0 fixes the problem by checking for ads first, and using just machine$ for non-ADS environments. I'm not happy that it may result in more than one call to net_ads_check(), however.

Index: source/utils/net.c
===================================================================
--- source/utils/net.c  (revision 13996)
+++ source/utils/net.c  (working copy)
@@ -286,8 +286,15 @@
 
        user_name = NULL;
        opt_password = secrets_fetch_machine_password(opt_target_workgroup, NULL, NULL);
-       if (asprintf(&user_name, "%s$@%s", global_myname(), lp_realm()) == -1) {
-               return -1;
+
+       if ( net_ads_check() == 0 ) {
+               if (asprintf(&user_name, "%s$@%s", global_myname(), lp_realm()) == -1) {
+                       return -1;
+               }
+       } else {
+               if (asprintf(&user_name, "%s$", global_myname(), lp_realm()) == -1) {
+                       return -1;
+               }
        }
        opt_user_name = user_name;
        return 0;