I installed the AD provider separately and am using mixed-mode forms based authentication in 4.6.2 (upg. from 4.5.3). when i try to log in as a domain user who hasn't logged into DNN previously, it says login failed. but when logging in as a domain user for which DNN has/had created a local a/c previously, it lets me through, even after i delete this latter a/c from DNN (although, it doesn't add me to the DNN admins group automatically like it used to for users in the Domain Admins group but thats a diff. issue). Anyway, i know the credentials are being checked against AD because we have a domain policy to lock an account after 3 unsuccessful attempts and the accounts ARE getting locked if we try incorrect passwords 3 times in a row. so i see the problem as DNN not being able to create a local a/c for "new" domain users after successfully authenticating against AD.

Also, from all the testing, it seems like the domain password is being stored in DNN as well, which is very uncomforting. I can log in using AD credentials even with the 'Standard' login selected and I know that it is not checking against AD because even if I enter incorrect passwords more than 3 times, it does not lock out my AD a/c - on the contrary, it locks out my DNN a/c after 5 invalid attempts for 10 mins. (the DNN default).

Can you please shed some light on these issues? Thanks! ~M$

Yes; 'previously working and then deleted' accounts get recreated in DNN after successful AD login but no new AD accounts (ie. AD accounts DNN has never known about) are being created; I am able to create local DNN accounts from the User Accounts page though. The AD setup seems to be happy in all its 'OK in green triangle' glory -> Accessing Global Catalog: OK Checking Root Domain: OK Accessing LDAP: OK Find all domains in network: 1 Domain(s): <domain>.

Btw, if the domain password is stored in DNN, can you list a couple of real benefits of using AD authentication? I am trying to gauge if its worth it for the small number of content editors we have right now.