I am running LDAP Authentication Plugin (Version 1.2d) (r83086) and I discovered that $wgLDAPExcludedGroups does not work without $wgLDAPRequiredGroups. I suspect that the getGroups function (first line below the "Find group" section) has to be modified to account for the case when users only specify groups for exclusion. Until that is fixed, one can set $wgLDAPUseLDAPGroups to true, as a work-around.
Topic on Extension talk:LDAP Authentication
Ah, well, that sucks. I'll take a look at this and hopefully have it fixed for next release.