The preconditions for failure are: 1) Windows 2008 domain functional level (so Windows will provide AES encrypted tickets) 2) AES defined in krb5.conf we dept verified this fix back in 2008. We originally fixed this in the Samba 3.0.32 days.
Does 4.0.0 still has this problem?