Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
In user manager domain , there is option to allow user to dialin . when you forward authentication to NT Domain Controllers , if users are not allowed to dialin , Cisco Secure will not authenticated .I hope it will work