Just opened a case with Netscaler support seeing issues with 13.0 and load balanced LDAPS VIP. If authentication policy is changed to not use the Netscaler VIP and either hit the domain controller directly or use a DNS load balanced name it functions.

maybe a backup global policy is bound?

If you configure the LDAP server IP or the DNS, the traffic likely originates from the NSIP (management IP) and if you run the connetion via LB, then the traffic originates from SNIP (subnet IP). I would capture network trace of both of the cases and see what happens. I'd suspect you might have a routing / firewall -related issue?

We completed a test on a domain controller. It was functional and at the final restart for patching it was no longer accessible. I’m out of the office till next week and will engage with support when I returrn.