May also want to check to see if the computer object already exists in AD. If the account does exist, the join account also needs the ability to modify that account either by virtue of being the creator/owner or by having the permission to modify computer objects in the target OU.