Looks like more is needed if the host had installed and joined correctly - the fix I mentioned above only worked when the host object existed, but the host hadn't actually used it.  I get more issues trying to disable hosts which had successfully installed:

<pre>
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: raw: host_disable(u'realm4.example.org')
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: host_disable(u'realm4.example.org')
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: raw: service_find(u'realm4.example.org')
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: service_find(u'realm4.example.org', all=False, raw=False, no_members=False, pkey_only=False)
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: raw: cert_show(u'14')
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: cert_show(u'14')
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: IPA: virtual verify retrieve certificate
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: Not granted by ACI to retrieve certificate, looking at principal
[Fri Mar 28 10:28:16 2014] [error] ipa: INFO: realm-proxy@EXAMPLE.ORG: host_disable(u'realm4.example.org'): ACIError
[Fri Mar 28 10:28:16 2014] [error] ipa: DEBUG: response: ACIError: Insufficient access: Gettext('not allowed to perform this command', domain='ipa', localedir=None)
</pre>