John
We use LDAP also for both internal (LAN) and external (internet) authentication against our W2K3 server. It works very well as there is no additional password for the students to remember (assuming that they can remember their password in the first place 
).
Although it's much debated in these forums, we play safe and install our Moodle server outside the internal network on a DMZ. Our LDAP server sits in the internal network as usual.The only change needed was in the config.php for the NAT translation and in our firewall config to allow access from the Moodle server to the AD server (TCP port 389 for LDAP and 636 for LDAPS). We also force logins for anyone accessing from the internet as another security measure.
Ken