If you manually visit windowssignin.aspx then you are manually firing the authentication process instead of it happening automagically. In full authentication mode windowssignin.aspx is always hit.

The difference between the two URLs? http://website/desktopmodules/authentication/logon.aspx is left over from Tam's original module that you installed on your site and was changed to the second URL when it was incorporated into the core. I just went back into the DNN releases to 3.0.13 and can't find any indication that there's ever been a directory call Authentication under DesktopModules in the core code.

EDIT: To further clarify my first sentence in this post. If a user logs in manually using the DNN signin.ascx page there's code underneath that also calls the Authentication code if the user doesn't already exist in the database and if Windows Authentication has been checked on the Authentication page. This is one of the potential stumbling blocks that's faced when trying to get the AD Provider separated from the core. It's tied into a number of areas of the core and if it's not there, as it could be an optional install like any module, then all heck would break loose.

1. Is there a particular reason you can't use Forms authentication? Windows authentication is something that will be looked at in the future.

2. If you read my blog and the sticky posts you'll see that this is a bug that cropped up in 4.5.1 and is fixed in the 4.5.4 release (currently undergoing testing). It was a simple oversite of case sensitivity in programming and not intentional.