Ldap – Kerberos broken when upgrading Snow Leopard Server to Mountain Lion

I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools from the app store (as recommended by Apple).

Kerberos is not working properly. The server has a bunch of network users stored in Open Directory. When I try to screen share the server, which uses Kerberos behind the scenes to authenticate, I get informed of an invalid password.

Initially it was failing at Got a canonicalize request for a LKDC realm from local-ipc, and stating it could not find a LKDC realm. I followed these instructions to regenerate the LKDC on the server:

• Repeat sudo rm -rf /var/db/krb5kdc
• sudo rm -rf /etc/krb5.keytab
• Open Keychain Access and search for 'kdc' then deleting the 3 com.apple.kerberos.kdc items.
• Run the command to reinstall the LKDC sudo /usr/libexec/configureLocalKDC this is non-destructive so can be rerun without upsetting anything.
• Re Bind the client to the server.

After that, the system log states this when I try and log in to screen sharing from another Mac:

kdc[48]: AS-REQ amy@LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA from fe80::cabc:c8ff:fec5:4b93%en0:53175 for krbtgt/LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA@LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA
kdc[48]: UNKNOWN -- amy@LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA: no such entry found in hdb
screensharingd[582]: Authentication: FAILED :: User Name: amy :: Viewer Address: 192.168.1.44 :: Type: DH

The following is in the opendirectoryd log, which looks suspicious:

38.938 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0
38.938, Module: AppleODClientLDAP - unable to create LDAP connection context - no server specified
38.938 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0
38.938, Module: AppleODClientLDAP - unable to open connection to LDAP server - unable to create connection context

Also on startup in the system log, I'm getting

servermgrd[107]: servermgr_accounts: got error 5000 trying to auth to local LDAP node

If I call kinit in the terminal, it asks for my password and then validates it (it tells me if it is incorrect). At that point I get this log (I've replaced our company domain with OURCOMPANY, but it's getting it right):

kdc[48]: AS-REQ amy@OWL.OURCOMPANY.COM from 127.0.0.1:59175 for krbtgt/OWL.OURCOMPANY.COM@OWL.OURCOMPANY.COM
kernel[0]: Sandbox: kcm(690) deny mach-lookup com.apple.networkd
kdc[48]: UNKNOWN -- amy@OWL.OURCOMPANY.COM: no such entry found in hdb
kinit[693]: krb5_sendto_context is called on main thread, its a blocking api

Edit:

If I try kinit now I get:

kinit
amy@OWL.OURCOMPANY.COM's Password: 
kinit: krb5_get_init_creds: Client (amy@OWL.OURCOMPANY.COM) unknown

Can anyone suggest how I get Kerberos, Open Directory and LDAP all talking together again?