DNS suffix and "change primary DNS suffix when domain membership c

Problem: If I go to system properties \computer name tab. "change" button
and then on the "Computer Name/Domain Changes" hit the more button.
Fill in a value for "primary DNS suffix of this computer" and uncheck
"change primary DNS suffix when domain membership changes" and click ok twice.

Vista comes back with an error:
Computer Name/Domain Changes:

The following error occurred attempting to change the DNS suffix
synchronization flag:

Access is denied.

I am still in a workgroup at this point, using DHCP to get my IP address.

This was no problem with any past clients.
-----
Background: We don't use DDNS. When we join a machine to AD, as part of the
procedure we uncheck the "change primary DNS suffix when domain membership
changes", so the computer entries in the ad do not have the suffix for our AD
in the distinguishedname field, we typically put our "department's dns
suffix" as the "Primary DNS suffix of this computer" the suffix. So the
distinguishedname in the computer record will have the dns suffix for our
department. Then if the computer really needs to be found, we register it in
the Unix DNS. (We still have WINS running but that is another story and helps
make this mess work.)