APM joining the Domain

That's always an interesting question, and really depends on your definition of "joining the domain". In order for a typical *NIX platform to join a Windows domain, that usually requires creating an account in the AD and exporting the keytab from the AD and importing to the *NIX box. If that qualifies as "joining the domain", then yes, APM does indeed join the domain in the client side Kerberos (AAA) config. You create an AD service account, export the keytab, import the keytab to APM as a AAA object, and then configure Kerberos Authentication in the visual policy with that AAA object. The beautiful thing about this process is that APM could essentially join multiple domains.