Нашел ответ в описании к сквиду:
Setup the authenticators. (Samba-2.2.X)
Add the following to enable both the winbind basic and ntlm authenticators. IE will use ntlm and everything else basic:
auth_param ntlm program /usr/local/squid/libexec/wb_ntlmauth
auth_param ntlm children 5
auth_param ntlm max_challenge_reuses 0
auth_param ntlm max_challenge_lifetime 2 minutes
auth_param basic program /usr/local/squid/libexec/wb_auth
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
Note: For Samba-3.X the Samba ntlm_auth helper is used instead of the wb_ntlmauth and wb_auth helpers above. This helper supports all Squid versions and both ntlm and basic schemes via the --helper-protocol= option. See the Samba documentation for details.
Правда есть одно неудобство:
при заходе через IE в логах домен\юзер
при использовании оперы только юзер, что дает два разных пользователя в отчетах sarg.