Thanks, net11. It sounds like you have the VLANs configured properly on the switched network. So two things come to mind regarding what you are observing:
1) Please be sure that the role that the "AD computers" authenticate into have an explicit allow statement for DHCP in the role policy - or something more encompassing. New in 2.2.1.x is the requirement to explicitly allow DHCP (or something more encompassing, like a rule that allows any traffic) in the role, whereas this was implicit in 2.1.
2) The "vLoc" location is one that is automatically identified by the vWLAN by virtue of the fact that it is the native VLAN for at least one (and in your case, all) of the APs. As such, this "vLoc" location should be leveraged for the traffic flow in your role rather than defining a separate VLAN for VLAN ID 101. Allow that "vLoc" to reappear, as it should do every time an AP checks in, and then place traffic flow for the appropriate role into it.
Please let me know if these suggestions help.
I applied your #2 suggestion and our AD computers are now receiving 10.1.x.x addresses. Thank you for the help.