It suggests the error might be the result of a permissions issue. Specifically, that the user that Checkmk uses to bind to AD does not have permission to read the pwdlastset attribute.
A couple of years ago, someone in these forums solved the same error message by disabling Check for expiration: