I confirm that after disabling UAC it works. By default W2k8 comes with local policies Admin approval for Built-In Administrator = disabled and Run all administrators in Admin Approval = enabled, which explains why it did work for domain admin (I was on domain controller where domain admin == local admin). Changing Behaviour of elevation prompt for administrators to Elevate without prompting does not fix it.
In plain words it means that RBAC with SDW CLI is impossible with UAC enabled. Not nice ...