After a pending update, the department Linux systems will require a password after logging in via "csguest" (but before entering the AD account and password) to better match the Windows csguest system and thus avoid confusion. As in Windows, "csguest" will do for the password (though it's not actually checked on the Linux side).
Relatedly, the extra password query that had appeared after the AD account queries has been removed.