The problem is that unless you are authenticating the machine to AD as well, then when you log onto the laptop, you are using

cached domain credentials and then the user is authenticating to the wireless.  In order for login scripts, group policy changes, etc to work, the machine must authenticate to the wireless so it is on the domain.  Then when you log onto the laptop, you are logging into the domain, just like with a wired PC.  So what you need to use is a wireless suplicant like WZC or CSSC that integrates into the msgina of the OS that allows authentication before login.  With the WZC, you will see an option to "authenticate as computer when computer information is available" on the Authentication tab of your wireless profile. Check out step 9 of the Client configuration section of this document  http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a00807917aa.shtml#t31.

Your RADIUS server would also need to allow computers to authenticate.

Thanks,

Lee