I have a Watchguard + NPS (Radius) solution running for authenticating VPN users. Users can log in with their AD user + password but not with their domain prefix in front. - domain/user + password.