Use Port Binding Permissions on Windows

Are there any other NTFS permissions set that may be denying domain users or any other group your user account may be a part of.

Remember that deny's always override allow's.

First off stop using the AD\Administrator account. Shared accounts like that are just all sorts of a bad idea. Everyone who needs domain admin access should have a separate account just for doing domain admin things. Create a service account just for MDT. It doesn't even have to be a domain admin. All it needs to do is join computers to the domain. You can set it in the customsettings.ini or mdt database.

DomainAdmin = DeploymentAccount
DomainAdminDomain = Domain.local
DomainAdminPassword = S@msFantas1cP0rkSh0p
JoinDomain = Domain.local
MachineObjectOU = ComputerDeploymentOU

To avoid giving my deployment account domain admin rights I created a deployment team group. added that account along with the techs that need access for deployments and gave it access to add / remove computers from an OU for deployment. When you go to deploy a computer it should add to that OU without problems. If you wanted a little more control you could always pre-create the computer account too. To do that just right click on the OU, select new -> computer. Then in the computer object creation screen change the user or group to your deployment team. I like doing this because it lets me plan out my deployments a little better. This should fix the lockout problems you're having with that account. If you're still getting locked out then it's time to dig deeper. At least this way you can be sure your deployment's aren't the cause.