I have figured out that this is happening (on two separate installs) when you create new pool and you check the "Select AD Container from Domain Accounts" box... Once you check it, you can not deselect it using edit button.

My guess is that this part is for Sysprep or linked clones only and does not apply to full clones. When leaving it unchecked it works - but ofcourse I have to handle domain rejoin using RunOnceScript= then. Which is shame when it works for instant clones I see no obstacle why it could not work for full clones as well. The machine account is properly created in AD, and agent could easily use offlinejoin as it does with linked clones. Or am I missing something?