You need to use machine authentication only. I have had many bad experiences with trying to get the "Connect directly before user logon" method working, and no good ones.
The best results always come from using machine auth only. Alternatively, set the wireless profile to use "machine OR user authentication". This way the machine with auth when no one logs in. At some point after the user has logged on (usually towards the end, although I don't know what determines the time interval) it will switch to user auth. Depending on your network, you may drop packets, 1 or more.
On ours it dropped one packet, and you could see the network icon in the system tray D/C then R/C. It appeared to work fine but we didn't want to risk the switchover happening during logon e.g. during network drive mapping or folder redirection, so we ended up going with machine auth only, which works flawlessly.
Obviously the machines will need to be domain joined and/or have the proper certificates.