adcli join should enable already existing computer object
It seem to me that the adcli join process is able to set the kerberos password for an existing computer object, but it fail to update the enable flag in UserAccountControl, blocking the machine from using this kerberos ticket.
Please adjust adcli to change the UserAccountControl value and set the enable flag when joining a machine for the first time. It should probably leave the setting alone when doing 'update'.