APM Connectivity Issue

I guess it depends, but the AD AAA has a monitor built into it and should log any failures. I'd usually recommend something like an LDAP monitor if you're specifying a pool of AD servers. Otherwise you could remove the pool, apply just the domain name, and let the AD do it's own load balancing. I do sort of recall a bug in the 11.2/11.3 days where a failed monitor would blackhole an AD server for up to 10 minutes, but the previously mentioned workaround should prevent that altogether.