AD uses both Kerberos and LDAP.
https://technet.microsoft.com/en-us/library/2005.01.activedirectory.aspx
I am going to boil this down simplistically, since it seems you need to start from the very beginning. Kerberos is the default authentication (and authorization) protocol used by Active Directory, though it is classically thought of as an authentication protocol only. Kerberos is platform-independent and was invented at MIT, and Microsoft later adopted it beginning Windows 2000 Active Directory to provide you single sign-on access (which means you only enter your password one time when you first logon) to subsequent network resources on your network and not challenge you again for a username and password. Kerberos is involved in nearly everything, from the moment you first logon to access your computer, to accessing the SYSVOL share on Domain Controllers, by handing out what are known as tickets, which are encrypted. Kerberos largely replaced NTLM, an older and Microsoft’s original (with Windows NT) authentication protocol. LDAP is also an authentication and authorization protocol, and also methodology of organizing objects such as users, computers, and organizational units within a directory, such as Active Directory. It is basically the list view of what you see when you open up the Active Directory Users and Computers console. Kerberos is more secure than LDAP, and they are often used together. For example, when you open up the Active Directory Users and Computers console, your computer first obtains a ticket to access your Domain Controller and then uses LDAP to actually use the console itself when working with objects such as users or OUs. Kerberos and LDAP allow you to run a heterogeneous network of Windows, Linux, UNIX and even Apple Mac clients on a Microsoft Active Directory network.
And yes, it is encrypted OOB.
Kerberos is used for authentication, LDAP for authorization
Kerberos only stores logins & passwords (and a bunch of options stating if kerberos tickets are forwardable etc.), and that's about it.
once kerberos authenticated you, your permissions (group membership etc.) are managed within the LDAP directory.
