Here is the error from both IAS servers:

Access request for user host/RO-MLR52-02.instruct.rhnet.org was discarded.
Fully-Qualified-User-Name =
NAS-IP-Address = 10.12.12.146
NAS-Identifier =
Called-Station-Identifier = 00-90-0B-08-5A-88:Roth
Calling-Station-Identifier = 00-13-CE-55-92-1D
Client-Friendly-Name = Meru #2
Client-IP-Address = 10.12.12.146
NAS-Port-Type = Wireless - IEEE 802.11
NAS-Port = 4128
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server =
Reason-Code = 3
Reason = The Remote Authentication Dial-In User Service (RADIUS) request
was not properly formatted.

------------------------------


Using machine based authentication only, Machine works for a while, then
without warning won't find the domain. Refreshing GP over the wire fixes the
problem for a while. I have checked all relevant policies (wireless; network
startup) and can see no problem.