one thing to keep in mind for whenever you make that change

the user name seen by mojoportal under windows auth may be different than the raw ldap user name. I think it will be like domain/username under windows auth rather than just username (if I recall correctly)

so it will create new users rather than match the previous existing ldap users

if that happens then you may need to remove the new users and run a query to update the loginname on existing users so it matches what is seen under windows auth

ldap authentication does not use a password from the database so there is nothing to sync and we would not want to store a copy of the users ldap/ad password in the db ever.

so if the ldap password changes then the next time the user logs into the site he must use the new one since it is always talking directly to ldap server to authenticate.

we do generate a random password for the db record at the time of user creation, but that would only be used if enabling db auth in addition to ldap or if you later turned off ldap and used db auth instead