Join to domain is not valid: {Access Denied}

TrueNAS General
,
1

Hi!
I’m stuck with ad joining. Here is some info:

  1. Win2016 Ad with 2 controllers in same forest. dns records, ntp configured and synced.
  2. Applaince is TRUENAS SCALE OS Version:25.04.2.4

I do join to active directory and it works fine:
it shows Status: HEALTHY and synced users and group from active directory.
But in the log I see in the domain_testjoin_1758712655.7333765.log:

Registering messaging pointer for type 1 - private_data=(nil)
Registering messaging pointer for type 5 - private_data=(nil)
Registering messaging pointer for type 51 - private_data=(nil)
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface ens81f0np0 ip=10.20.2.6 bcast=10.20.2.255 netmask=255.255.255.0
ldb: ltdb: tdb(/var/db/system/samba4/private/secrets.ldb): tdb_open_ex: could not open file /var/db/system/samba4/private/secrets.ldb: No such file >

ldb: Unable to open tdb '/var/db/system/samba4/private/secrets.ldb': No such file or directory
ldb: Failed to connect to '/var/db/system/samba4/private/secrets.ldb' with backend 'tdb': Unable to open tdb '/var/db/system/samba4/private/secrets.>
Could not find machine account in secrets database: Failed to fetch machine account password for CORP from both secrets.ldb (Could not open secrets.>
net_ads_join_ok: Failed to get machine credentials
Join to domain is not valid: {Access Denied} A process has requested access to an object but has not been granted those access rights.
return code = -1
Freeing parametrics:

When try to mount share from win client (ad server) it shows 0x80004005 unknown error. I tryed rejoin, clear /var/db/system/samba4/private/ with no luck. klist looks good and machine account was created. Honestly I’m out of ideas and need some help.
Thanks!