I'm building out a multisite installation. For unknown reasons, the 'admin' user password needs to be reset each time I join a new FreeIPA replica.  

It seems to happen a minute or two after the ipa-replica-install completes.  Attempts to kinit immediately afterward usually works.

Here's my ipa-replica install command I'm using:

ipa-replica-install -n {domain} -r {realm} -d \
  --server={existing_ipa_server} \
  --setup-adtrust --add-agents --mkhomedir \
  --ntp-pool={my_ntp_pool} \
  -p $otp

How do I track down the cause of this?

-Chip