This worked great. Here is the code for the module (below). I added it to the home page set to be viewable by Unauthenticated Users only, so when someone's AD authentication is not recognized, the redirect code will fire, sending them to WindowsSignin.aspx, which then redirects them back to the home page. So, they never even notice that there was a problem. I agree it's not the ideal solution (which would be to know WHY it's failing, and PREVENT it), but this is definitely a pretty smooth workaround. I appreciate your time.
<!--Control Language="VB" ClassName="Monroe.ForceAuth" Inherits="DotNetNuke.Entities.Modules.PortalModuleBase"-->
<!--Import Namespace="DotNetNuke.Security.PortalSecurity"-->
<%@ Control Language="VB" ClassName="Monroe.ForceAuth" Inherits="DotNetNuke.Entities.Modules.PortalModuleBase" %>
<%@ Import Namespace="DotNetNuke" %>
<%@ Import Namespace="DotNetNuke.Security.PortalSecurity" %>
<script runat="server">
Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs)
Try
Dim theUser As DotNetNuke.Entities.Users.UserInfo = DotNetNuke.Entities.Users.UserController.GetCurrentUserInfo
Dim usrName As String = theUser.Username
If usrName Is Nothing Then
Response.Redirect("~/DesktopModules/AuthenticationServices/ActiveDirectory/WindowsSignin.aspx")
Else
DNNUserLiteral.Text = theUser.Username
End If
Catch ex As Exception
DNNUserLiteral.Text = ex.Message
End Try
End Sub
</script>
<p><ASP:Literal id="DNNUserLiteral" runat="server" EnableViewState="false" /></p>