samba - Mar 2018 - Kerberos errors during ads operations

I was attempting to view enctypes of various principals on my domain after
getting some errors like "KDC has no support for encryption type" on a
DC
running Samba 4.7.6 with MIT KDC .

Running `net ads enctypes list MACHINEACCOUNT$` gives an error:
kinit: Client 'WORKGROUP at AD.DOMAIN.NAME' not found in Kerberos
database
while getting initial credentials

What could cause this error?