This is something that gets me, as Microsoft (2K+) uses Kerberos authentication, would it not make it easier to use that? I have several machines intergrated into an AD and it's far easier to setup and use once you have it intergrated into PAM.

Just a though.