Can't change AD password through APM

AD auth\query use Kerberos on the back side. I have observed that the AD AAA uses DC pool members like a SNAT pool, where one address is exhausted before moving to the next one. If this causes a problem on the DC, the AAA will mark the IP as offline for several minutes. A "best practice" solution is to select Direct in the AD AAA configuration, add the Domain Name in uppercase, and the admin account/password. AD will natively load balance itself and return the best DC for the job in an SRV query response.