Universal Prompt doesn't work before Windows Sign-On

Using Duo to protect our VPN application, which works for users who connect their VPN both BEFORE and AFTER Windows sign-on (they have the option of doing both, and both worked). When we switch to the Universal Prompt, it breaks VPN authentication when user connects BEFORE Windows sign-on (still works AFTER). Any idea what Universal Prompt might be trying to do that doesn’t work when it doesn’t have a signed-in user? We see Universal Prompt attempt to load but it sits there with a blank screen. Do we need to allow something to run in WIndows to make this work? is there a way to debug what is happening with Duo’s Universal Prompt?