Jabber can't auth with Win 2003 AD Server

Question

I've been running OS X Server since Lion on this particular Mini. During the past year+ that we've had the server up, it's been running the iChat/Messages/Jabber server without issue.
I upgraded to Server 2.2.2 this weekend, and now no one can connect to Jabber. All other services (Wiki, web, File, Calendar, Contacts, Profile Manager, and more) work just fine.
We are in a mixed environment, with Windows Server 2003 Active Directory hosting all the user accounts. The Mini is properly bound to the AD domain. I went through about 3 hours of troubleshooting with Apple this morning to get it running, and after all that, the support guy threw up his hands and said there wasn't anything else he could do. He was able to verify that accounts logged in on the server itself with either Local or OpenDirectory accounts worked just fine. It's only the AD users that can't connect to the Jabber server. Obviously, a Windows problem...
What we see in the log is the following repeated whenever someone tries to login to the server:
Oct 21 16:38:48 groupware.hplnet.org jabberd/c2s[13235]: [10] [::ffff:10.1.2.66, port=56473] connect
Oct 21 16:38:48 groupware.hplnet.org jabberd/c2s[13235]: [10] [::ffff:10.1.2.66, port=56473] disconnect jid=unbound, packets: 0
These 2 events happen simultaneously to the human eye. On my Mac, using Messages on ML, I get a warning that I'm disconnected from the server and it prompts me for a new password. Windows users are seeing similar behavior.
I recall that back in the past using Lion, I had to remove the use of cram-md5 and rely solely upon plaintext credentials for authentication to the Windows Server. Even though the c2s.xml file has now changed location (now at /Library/Server/Messages/Config/jabberd/), I tried using the info on this old KB article (option 2) to get the system to communicate with the AD, to no avail.
Again, the server starts and runs just fine, and I see NO errors in startup; . I can connect with local and OD accounts. AD accounts work with all other services. Only the Jabber + AD combination is broken.
Any ideas on what I can try next?

Answer 1

Another detail, just discovered:
I have found the following error via the Console logs, right at the end of jabberd startup:
10/23/13 12:39:14.512 PM jabberd/sm[63801]: session started: jid=[email protected]/groupware
10/23/13 12:39:14.600 PM jabberd/s2s[63804]: dns lookup for ourdomain.org returned 1 result (ttl 3600)
10/23/13 12:39:14.600 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] outgoing connection for 'ourdomain.org'
10/23/13 12:39:14.601 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] write error: Broken pipe (32)
10/23/13 12:39:14.601 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] disconnect, packets: 0
10/23/13 12:39:14.602 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] outgoing connection for 'ourdomain.org'
10/23/13 12:39:14.602 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] write error: Broken pipe (32)
10/23/13 12:39:14.603 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] disconnect, packets: 0
10/23/13 12:39:14.603 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] outgoing connection for 'ourdomain.org'
10/23/13 12:39:14.603 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] write error: Broken pipe (32)
10/23/13 12:39:14.603 PM jabberd/s2s[63804]: [8] [10.1.2.50, port=5269] disconnect, packets: 0
The number of Broken pipes varies each time I start jabber.
I'm still struggling to get this going. I was tempted to bypass the <module>apple_od</module> and use LDAP instead, but the sheer amount of manual configuration when I am no LDAP expert and have no guidance is mind numbing. And that really doesn't resolve the problem, just establishes a workaround.
I still wish I could find out why this 2.2.2 update borked jabber's authentication to my AD server, but nothing else... (and yes, I did try turning off my OS X and Windows firewalls).
If I can't find out what went wrong, what's folks opinions of restoring just my jabber installation from my Time Machine backup from last week, before I did the update?