This is really bugging me. I can't auth 10.4 clients to our AD using the Apple AD plugin unless I disable the IPSEC filter of the domain controllers.
I finally ended up finding the culprit. So here are the ports you need open on the domain controllers for AD auth to work.
53,88,389,464,3268