I am working with DNN 7.3.4 and ActiveDirectory module 5.0.6.  I want to use ActiveDirectory to replace our current authentication provider.

I removed the current provider and installed ActiveDirectory module and configured for IIS7.5 per instructions.  In the module settings I have AD configured to create user account if one does not exist.  The first issue I faced was that the first login worked and a new user account was created.  I think this was because the AD module stored the domain\username where the existing account was just username with no domain.  The second login for the same domain user did not work because the site was not setup for password retrieval.  I modified the web.config to allow password retrieval and all worked.

My first question is why does the AD module even try to retrieve a password from the local store?  If we are using AD authentication why does it care what password is in the aspnet_membership table?

If all domain users are going to have a new user account created when they first login how can I associate these users with existing roles?

What is the recommended configuration when migrating to the AD module from another authentication provider?