Thanks Jim, that solved it!
For completeness, I did run the install again. Here's how it went:
[root@myserver RT-Extension-CommandByMail-2.01]# perl Makefile.PL
Using RT configuration from /opt/rt4/lib/RT.pm:
etc=> /opt/rt4/local/plugins/RT-Extension-CommandByMail/etc
lib=>
Re: SSO with Windows/Domain-Login
You can use ntlm auth on your webserver and configure RT to user the Webserver
Authentication
https://docs.bestpractical.com/rt/4.2.12/authentication.html#WebRemoteUserAuth
Chrome + IE support NTLM out of the box. Firefox needs some config: