Sync NT4 SAM setting with Samba4 - possible?

Question

I've got a Samba4 installation set up as a backup domain controller:

james@photon:~$ testparm
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[netlogon]"
Processing section "[profiles]"
Processing section "[printers]"
Processing section "[print$]"
Loaded services file OK.
Server role: ROLE_DOMAIN_BDC
Press enter to see a dump of your service definitions

[global]
    workgroup = NT4Domain
    server string = %h NT4 BDC (Samba4, Linux)
    interfaces = lo, eth1
    bind interfaces only = Yes
    server role = classic backup domain controller
    map to guest = Bad User
    obey pam restrictions = Yes
    passdb backend = ldapsam:ldap://127.0.0.1/
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    name resolve order = wins, bcast, hosts
    client signing = if_required
    server signing = if_required
    add user script = /usr/sbin/smbldap-useradd -m '%u' -t 1
    add group script = /usr/sbin/smbldap-groupadd -p '%g'
    add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g'
    set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
    add machine script = /usr/sbin/smbldap-useradd -w '%u' -t 1
    logon script = scripts\logon.cmd
    logon path = \\%L\profiles\%U
    logon drive = H:
    logon home = \\%L\%U
    domain logons = Yes
    domain master = No
    dns proxy = No
    wins server = ip.of.nt4.box
    ldap admin dn = cn=admin,dc=thisdomain
    ldap group suffix = ou=Groups
    ldap idmap suffix = ou=Idmap
    ldap machine suffix = ou=People
    ldap passwd sync = yes
    ldap suffix = dc=thisdomain
    ldap ssl = no
    ldap timeout = 20
    ldap user suffix = ou=People
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    winbind cache time = 3600
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind use default domain = Yes
    winbind offline logon = Yes
    idmap config * : backend = tdb
    ea support = Yes
    map acl inherit = Yes

[homes]
    comment = Home Directories
    valid users = %S
    read only = No
    create mask = 0775
    directory mask = 0775
    browseable = No

[netlogon]
    comment = Network Logon Service
    path = /home/samba/netlogon
    guest ok = Yes

[profiles]
    comment = Users profiles
    path = /home/samba/profiles
    create mask = 0600
    directory mask = 0700
    browseable = No

[printers]
    comment = All Printers
    path = /var/spool/samba
    create mask = 0700
    printable = Yes
    print ok = Yes
    browseable = No

[print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers
    write list = root, @lpadmin

It is joined to my NT4 domain. The shared printer is accessible, the netlogon share is visible, the user shares are visible and browsable by the correct (locally set up) users from Windows machines in the domain. The machine account is visible in the NT4 domain controller. It works.

However, I can't get net rpc vampire to work. There are several hundred user accounts stored on the NT4 domain controller, and I need to get the synchronised to the (working) LDAP instance on the Samba machine so that we can decomission the NT4 machine.

james@photon:~$ sudo net rpc join -U NT4AdminAccount%secret
Joined domain NT4Domain.

However:

sudo net rpc vampire -U NT4AdminAccount%secret
DC is not running Active Directory
cli_rpc_pipe_open_schannel: failed to get schannel session key from server 127.0.0.1 for domain NT4Domain.
Could not initialise schannel netlogon pipe. Error was NT_STATUS_ACCESS_DENIED

And:

sudo net rpc vampire -S NT4DC -U NT4AdminAccount%secret
DC is not running Active Directory
cli_rpc_pipe_open_schannel: failed to get schannel session key from server data1 for domain ATMOS.
Could not initialise schannel netlogon pipe. Error was NT_STATUS_INVALID_COMPUTER_NAME

The relevant lines I see when trying to run vampire with -d=10 are:

result                   : NT_STATUS_INVALID_COMPUTER_NAME
get_schannel_session_key_common: rpccli_netlogon_setup_creds failed with result NT_STATUS_INVALID_COMPUTER_NAME to server NT4DC, domain NT4Domain, machine account SAMBASERVER.
cli_rpc_pipe_open_schannel: failed to get schannel session key from server data1 for domain ATMOS.
Could not initialise schannel netlogon pipe. Error was NT_STATUS_INVALID_COMPUTER_NAME
return code = -1
Freeing parametrics:

So, after all that, what's wrong? Is vampire now broken? I keep reading that it's been deprecated, but all the documentation I've seen for doing this with samba-tool domain join is about joining an active directory domain. That's not what we want to do. I'm also reading a lot about Kerberos in the context of the schannel session key error, but that's an active directory thing too isn't it? I though NT4 used LANMAN for those functions now covered by Kerberos. It seems only to be the vampire operation I'm having difficulty with. Everything else seems to work fine...

Thanks in advance.