Yes, the SNAC LAN Enforcer is designed to assign clients to specific VLANs based on Host Integrity checks and autnetication criteria.   VLAN assignments can occur for multiple reasons, such as no SNAC agent is installed or if AV is out of date.  Using RADIUS on your network in conjunction with the LAN Enforcer would be the best configuration for your environment - allowing RADIUS to manage the AD authentication process. 

Let me know if you have any outstanding questons.

Here a way I know how to do this:

You can use a custom Host Integrity policy to check to see if the machine in question is part of your AD Domain.

This information is stored in the registry, and you need to craft a custom policy to look at the following registry key.  Have the policy fail if it does not match the following key:

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\WinLogon\DefaultDomainName


Type: REG_SZ

Data: <YourDomainName>