First, my setup:
Windows 2008 R2 Standard / IIS 7.5
DNN v5.5.0
AD Provider v5.0.2
I set the managed pipeline mode to Classic right now (as mentioned in user guide for IIS 7), but I've tried both modes, it doesn't seem to make a difference.  I've done everything else specified in the user guide.
AD Authentication is enabled, default authentication is still enabled as well.  The authentication type in AD settings is Delegation.

The provider appears to be working as far as looking up a user given certain credentials, creating the user in DNN, and logging the user in.  However, I can only get this to work if I go directly to http://<servername>/DesktopModules/AuthenticationServices/ActiveDirectory/WindowsSignin.aspx.  So, since this page is set not not allow anonymous, it is presenting a challenge response to the browser and it's then doing its thing.  What I expected though, was as soon as I bring up http://<servername> it should redirect to the windowssignin.aspx page, create the user, log the user in, and redirect back to the home page.  Is that not how it's supposed to work?  If it's not how it's supposed to work by default, how would I get it to do that? 

I've seen conflicting information about impersonation being required and something about an iis6 metabase compatibility feature for Server 2008 / IIS 7.  The actual authentication seems to be working for me without any of those special requirements, even managed pipeline mode seems to work the same as classic, it just doesn't do an initial redirect to the WindowsSignin page.  I wondered if some of those requirements have been eliminated with later versions of the provider or DNN.

Any insight appreciated.

Thanks,
Chris

You can't set the persistence or timeout on the cookie that IIS writes. It's a random variable that lasts up to an hour. You could in .NET 1.0 I believe but not since then.