Make sure that domain joins work correctly when the DC disallows NTLM auth.