Solved. All Users Filter must be empty and User From Name Filter:(&(cn=%u)(objectclass=user)) must be changed to (&(sAMAAccountName=%u)(objectclass=user)) Another point is, the user trying to authenticate must be exists in User Base DN container or its subdirs