‘root’ user in both LDAPv3 and Local domains – cannot kerberise OD

Hello.
I hope someone can help me… I’ve hit a brick wall!

I have a 10.6.3 OS X Server which is an ODM, it has a replica on the LAN.
The ‘trouble’ started when I was trying to Kerberise OD for greater functionality to the 10.6 clients we are planning to push out.

Short version is that I cannot kerberise this service – the GUI just returns back blank waiting for another attempt (I have tried both root and diradmin), I know that root pw is OK (can log onto server and ssh).
I get this in Console (slightly edited info for ‘security’)

2010-05-24 21:29:23 BST – T[0x0000000103B04000] – Misconfiguration detected in hash ‘Global UID’:
2010-05-24 21:29:23 BST – T[0x0000000103B04000] – User ‘root’ (/LDAPv3/127.0.0.1) – ID 0 – UUID 122655F3-19E7-4FD1-988F-98Bxxxxxxxx – SID S-1-5-21-3724629426-2285134700-3052732264-1000
2010-05-24 21:29:23 BST – T[0x0000000103B04000] – User ‘root’ (/Local/Default) – ID 0 – UUID FFFFEEEE-DDDD-CCCC-BBBB-XXXX – SID S-1-5-18
2010-05-24 21:29:23 BST – T[0x0000000103B04000] – Misconfiguration detected in hash ‘User Name’:
2010-05-24 21:29:23 BST – T[0x0000000103B04000] – User ‘root’ (/LDAPv3/127.0.0.1) – ID 0 – UUID 122655F3-19E7-4FD1-988F-98B0xxxxxxxx – SID S-1-5-21-3724629426-2285134700-3052732264-1000
2010-05-24 21:29:23 BST – T[0x0000000103B04000] – User ‘root’ (/Local/Default) – ID 0 – UUID FFFFEEEE-DDDD-CCCC-BBBB-XXXX– SID S-1-5-18

With some research I have noted that other people have challenges with identical User IDs (I don’t) or multiple shortnames (does not apply) but it has been noted that root ‘now’ exists in both Local and LDAP domains – I cannot see either in WGM even with ‘show all records) option applied… But I’ll say that another OS X server (standalone) that is a successful kerberised ODM doesn’t show them either..

However dscl indeed proves that the affected server considers them both active and indeed they have the same UID.

So it would appear that I cannot continue until this is resolved – I would have thought that the root in LDAP was unnecessary (or at least not critical? – Maybe :-/) But as always, highly reticent to go playing with a live server – maybe someone could give me some pointers or hold my hand?

Thanks for taking the time to review this question – I hope someone can shed some light.

All the best