Ok, I answered my own question.
Most of the information is on the openvpn site in various locations 🙂
I got it going this way:
Setup RADIUS on Windows 2008 server to authenticate against Active Directory (you get MS CHAP-v2):
Configuring Active Directory (Windows 2008 Server R2) RADIUS Server for OpenVPN Access Server
http://docs.openvpn.net/frequently-asked-questions/configuring-active-directory-windows-2008-server-r2-radius-server-for-openvpn-access-server/
Setup RADIUS on Access Server (need this to create users OTHER THAN the PAM user). Above link covers this also.
Once RADIUS setup, you can create User Permissions that get applied by matching the name you specify with the RADIUS login name. Also, you can check the log on Access Server to see RADIUS errors.
Configure Windows OpenVPN Client to Auto Authenticate. This is referred to as 'How to run the Desktop Client in Service Mode'.
http://openvpn.net/index.php/access-server/docs/admin-guides/383-how-to-run-the-openvpn-client-in-service-mode.html