PDC was running on a separate subnet, but routed appropriately. smbclient was returning NT_STATUS_PASSWORD_MUST_CHANGE so I tried: smbpasswd -r 192.168.1.5 -U myusername I would authenticate successfully (got a different error if I didn't), but every time smbpasswd would return NT_STATUS_ACCESS_DENIED. I carelessly neglected to preserve running -D, and once I changed initial password using an RDP connection to a windows machine on the domain, all future smbpasswd calls worked fine.
Oh, was using 3.0.22 - updating to 3.0.23d solved another problem with smbmount, so perhaps they are related. If I get an opportunity to retest this, and it works with 3.0.23d, I'll close this out.
Closing, feel free to re-open if 3.0.23 does not solve it. If you still got problems, please attach a sniff of the attempt. Volker