That's great that you got it running. You shouldn't have had to change your machine.config (just doing it on the web.config should've worked) but I'm glad it worked for you.

Ummmm sort of.....  The current AD provider is based off of Tam's ADSI work. The only real changes are what people have learned over time on their own and have shared with everyone else.

Under mixed-mode all users still have to login but can use the standard DNN login module. I'm not sure how Tam's login module worked but AD users have to enter their credentials as domain\username in the standard DNN login. What I've done on the intranet/internet site at work is I've put links on pages that contain non-public information that point to windowssignin.ascx and when users are on the intranet they can just click the link to get logged in.

Yup, you got it.