Thank you. I actually was pretty sure my user had too many privileges but it was one of those cases of making it work at the time. I definitely need to go back and remove some of those. Would love to see the patch (actually would love to see it incorporated into core plugin!!). I know that there have been a lot of improvements and changes to ldap lately and really appreciate all the work that has gone into it. For the first time ever, the change password on first login is now working for MSAD - yay!
I had already planned on this being my "security" year - so will add this to the list of things I need to do!