You can add some debugging output to the auth_user_login() function of the ntlm authentication. You can make that debugging output be HTML comments, so your users don't notice at all.
Just add a few:
echo "<!-- Code is reaching point XX -->\n";
where XX is a growing number each time you add an echo statement, and you'll be able to follow the code flow for the problematic users.
Then you can debug it further in nested functions in case you need it. This is the way I usually do it.
Saludos. Iñaki.