Be aware that VPN and domain authentication are two separate things. To enable VPN authentication on the PIX, to a Radius server, you will need something like the following:
crypto map client authentication vpnauth
aaa-server vpnauth protocol radius
aaa-server vpnauth (inside) host x.x.x.x cisco123
Your VPN users should now be prompted for a username/password when they VPN in, and the PIX will reference the IAS Radius server at x.x.x.x to authenticate the user. See http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00800b6099.shtml for details.
All this will give them however, is access into your network. They will not have "joined the domain" per se, they are just a host sitting logically on the inside of your PIX now. If you really want them to be authenticated to the domain properly, then on the VPN client enable the "Start before Login" feature. When they next boot up their PC and press CTRL-ALT-DEL to login, the VPN client will pop up allowing them to create the VPN connection to the PIX first. Once that is done they can then log into the Windows domain as normal and everything should look just as though they had logged in on the physical network (login scripts will run, drives will be mapped, etc).
Unfortunately with Win2k/XP once they have logged into Windows initially using cached credentials (because they were not on the local network), there's no way to then force them to re-login again once the VPN is up. You have to bring the VPN up BEFORE they log into Windows so that everything runs smoothly.
