The sambaNTpassword is not changed if the client joins again. Thus the new password is not synced to the S4 database. As a result the user can't get a kerberos ticket during the login.
The sambaNTPassword attribute is now set.
The sambaNTpassword now updates correctly, a kerberos ticket can be obtained -> Verified
UCC 1.0 has been released: http://forum.univention.de/viewtopic.php?f=26&t=2417 http://forum.univention.de/viewtopic.php?f=54&t=2418 If this error occurs again, please use "Clone This Bug".