@Aaron_Wilson, there is a matrix in the link I posted (which I've now fixed). If you have a Guest VLAN and a Authentication Failed VLAN configured, then the matrix suggests the Guest user should've been placed in the Authentication Failed VLAN if they fail authentication. (If you only have a Guest VLAN configured, and are using Hybrid authentication then it ends up in the Guest VLAN).
Ok, that took a few reads to process. Almost seems like it would have been better to specify the vlan for the failed scenarios, rather than the configured/un configured options defining what "guest", etc, means.