Health Monitor for Active directory VIP

You might want to just use a simple LDAP monitor against a pool of DCs listening on port 389 or 636. Example:

User Name: cn=administrator,cn=users,dc=mydomain,dc=com
Base: cn=users,dc=mydomain,dc=com
Filter: sAMAccountName=bill.user

This actually checks the ability to authenticate (simple bind with admin account), and performing queries (the search filter). This is probably as close as you're going to get without dropping into the management plane to test Kerberos auth.