OD + AD (Tiger Server and Client)

Here is the setup:

10.4.6 Server. Promoted it to OD Master. Created a couple of OD Accounts. Bound the clients, everything works fine. So, I bind the OD Master to AD. Then go to the client and bind it also to AD. In Directory Access, AD authentication comes before LDAP on both the client and the server. I run "sudo dsconfigad -enableSSO" in the command line.

Then I create a group in OD, and add an AD user to the OD group. I manage the dock preference on the OD group just to see if things are working.

At this point, my clients can login with AD credentials, but get none of the computer-specified management settings assigned in WGM to the computer list, and dock setting for the group does not take either. I can no longer login with OD credentials.

After logging back into the workstation as local admin, I try to unbind from the OD, and it says it can no longer communicate with the LDAP directory, and asks me to if I would like to forcibly remove the bind. AD cleanly unbinds.

I have consulted both the whitepaper ver 2.1 on OD/AD and the article written by Mike Bombich on the same topic. Neither seem to be giving me a working solution.

What am I missing?