It's been my experience that it's because the AD isn't allowing the ASPNET user or Network Service to read it (and rightly so). What I've had to do in the past is to uncomment the <impersonate="true" /> line and add a username and password to it (it ends up looking like <impersonate="true" userName="domain\username" password="password" />. I then had to give that user the same rights to the DNN install that ASPNET/NETWORK Service has.

EDIT: That said, other users have had no problem using Authentication even with that failing. However, I don't think rosynchronization will work if you have a requirement for it.