Bill,
Is the user able to login using AD Auth without using SSO from the BI LaunchPad. This will confirm the you have NO Server configuration issue.
Some other things to check for:
- Validate that the user belong to the Domain Group that mapped within CMS
- Compare the Users NT Account properties with working user
- Check Delegation Settings
- Check DES encryption setting
- check Kerberos settings
Regards,
Ajay