I installed WebSphere Portal express 6.1 on a Windows 2003 server in a demo environment and ran the config wizard to secure the server to an Active Directory running on a second server.
Adding an Active Directory user as a member of the preexisting "wpsadmins" group proved difficult and resulted in the "EJPAL3030E" error - most likely relating to a misconfigured group attribute.
As time was limited to complete the demo I simply logged into the Portal as the "wpsadmin" user, chose the AD user I wanted to promote to a Portal administrator and selected the icon to "duplicate role" of the wpsadmin user.
Now the AD user can see the "administration" tab in portal.