Win2k DC Login through VPN

I have the following configuration:

1 Win2K DC, on a private networkm, 192.168.100.x, connected to the “world” through a Cisco 506E Pix Firewall. I have a branch office, with a Cisco Pix Firewall (501), that has a permenant VPN tunnel to the main office. The inside of the branch office is net 192.168.1.x. Users can see domain resources, and use them (after authentication), through the VPN, even though their VPN address is 172.0.0.x. I want the users at the branch office to authenticate on login, instead of on resource access. Any thoughts? Is this a routing problem that they cannot really see the domain? I obviously could change the gatewatys and subnet masks, but I am not sure I want to do that.