from chinese I want to know about how auth windows AD on plone not ldap， I am not good at English thank you
As far as I know you can enable an LDAP interface in your ActiveDirectory, and Plone will use that LDAP.
In general you will not be able to convince your Windows admin to enable LDAP on AD installations.
Instead you need to take the rocky path through Kerberos.
-aj