Cisco VPN Client, changed XAUTH method shows Domain field

All,

Before:

Cisco VPN3030 Concentrator, internal groups defined, users authenticated
with XAUTH direct to NT domain controller. On client side, user is
prompted to enter Username and Password only. Everything is cool.

After:

Cisco VPN3030 Concentrator, internal groups defined, users authenticated
with XAUTH to RADIUS (ACS 3.2.2) which in turn authenticates to same NT
domain. On client side, user is prompted to enter Username, Password
*and Domain*.

I don't want the Domain field to appear. Can anyone explain why this
might be happening? I am actually using the 'RADIUS with Expiry' method
on the concentrator (I haven't tested with just 'RADIUS'). I thought
that might be relevant.

Authentication still works fine -- I just want to make the Domain field
go away, or at least know why it's appearing.

cheers,
Dale