But in this case you've got a machine that has already associated itself to the domain Machine Account, and just wants to pick up where it left off, no different than if you took the laptop away from the network, logged on and off then tried to log back on to the Domain. It's not as if you've logged onto another Domain - which would overwrite the security tokens on the client machine. It's not as if just connecting to another network while disconnected from the Domain is a problem - how could it be? Connecting to a Workgroup is certainly no more dangerous than using the internet.

You've always needed an Admin account/password to initially join a machine to a freshly minted machine account on a Domain. It's needing it to re-join the Domain that's the rub.

-Zeke