KB17325-Issues with the BlackBerry Enterprise Server in a Windows Server 2008 based Microsoft Active Directory environment
If you've got any 2008 domain controllers, check out this KB article.
Easiest way to identify if you're affected by this issue is to change the registry settings as instructed in the KB on your DC's. Watch the logs for a few minutes, and it'll confirm you've got the issue.
We were affected by the issue and it was very difficult to troubleshoot because our symptoms didn't match what the KB describes. However, increasing the number of NSPI connections immediately resolved the issue.