PMP 2013-12-10 with Mark Proehl figured out that we sould not wait for the AD ldap,
               changing the password in kerberos and the status update into ldap
               can take a long time (20 minutes or so)
               this will be the case for large distibuted AD domains