If you escape the '\' character when using a "domain\user" scheme for the bind_dn name, it will fail. gitlab-ctl reconfigure escapes characters, and if you pre-escape the '\', the resultant yaml file will have four (4) '\' characters.