Samba password update do not works when security=ADS...

It's a known bug:
http://lists.samba.org/archive/samba-technical/2005-April/040396.html

It's always true with Samba 3.6:

void attempt_machine_password_change(void)
{
        unsigned char trust_passwd_hash[16];
        time_t lct;
        void *lock;

        if (!global_machine_password_needs_changing) {
                return;
        }

        if (lp_security() != SEC_DOMAIN) {
                return;
        }
......
......
}