They shouldn't need to use a DNN userid/password to login, they should be automatically logged in if <add name="Authentication"... /> is uncommented. I'm guessing you haven't got it uncommented as there's a bug in the 4.8.0 core that shows up when that line is uncommented in the web.config.

Basically, if you set it up like I outlined in the user documentation your intranet users should have no problems getting logged in under 4.7.0 and below. I realize this isn't an ideal solution but it's the best I can give you until such time as I can figure out why DNN gets stuck in a loop when using Windows Authentication and if it's even related to the AD Provider.

Uncomment the line at the bottom of the httpModules section not the top one (that's left from the old AD Provider). The documentation in under the Project section (http://www.dotnetnuke.com/Products/Development/Projects/ProviderAuthentication/Downloads/tabid/852/Default.aspx)

Yes we do seem to be going in circles and I think it's because we both haven't been clear when we're speaking about Windows Authentication. You're coming from the web.config side and I'm coming from the AD Provider side. Unfortunately they're not the same thing though they do touch.

Essentially it boils down to this, Windows Authentication uncommented in the web.config doesn't work and from what I can tell it never has unless the user account is already in the DNN database. Unauthenticated/Unregistered users go in a constant loop because DNN is trying to authenticate the user's credentials from the computer they are signed onto against the database. So what needs to be done is someone needs to figure out why this happens and pass on that information to the Core team. If I have time I will take a look at it and I'll also converse with the Core team. It could be that if it worked before version 3.11 that their thinking was that users would use the AD provider and Forms Authentication. Or it could be that the AD Provider was meant as a work around to the problem. I don't know the answer to that.

That said, if you want users to be able to visit the site unauthenticated and Active Directory users to be able to log in you have two ways you can do it. Install the AD Provider and use Forms Authentication as I've laid out above and in the documentation, comment out all instances of <add name="Authentication"..../> under <httpModules> (this will allow users to simply surf the site), and add a link to http://<yourDNN_Install>/DesktopModules/AuthenticationServices/ActiveDirectory/WindowsSignin.aspx to allow intranet users to log in or manually add the users and have them log in manually.