is your user by any chance in the protected users group? there was something about that in the german sub-forum Login mit Protected Users - I guess the ldap module within checkmk is not compatible with the higher security requirements enforced by AD for these users.