When attempting to join the newly created domain, it failed with password errors.
Adding root with “smbpasswd -a root” fixed it, but I don’t want to undermine the ZTL controls by doing stuff manually if it is supposed to be available via the web interface.
Am I missing something?