I had RRAS set up for VPN access on a Windows Server 2003 network - all was
well. We've just come through a "consolidation" and the server that was
running RRAS has been moved to a new Forest. And my problems have started.

Users can connect via VPN to the RRAS server - they are authenticated and
the connection is established. However, when trying to browse the network
they receive a message stating their account is locked out (it's not). Or, in
some cases, they can browse the network file structure but not into areas
that require specific permissions. I did some testing and found that while
connected I could access an Outlook Web Access mailbox using an IP on the
local subnet (I'm guessing because of a different authentication mechanism)
but could not connect to network files - I got the "account locked out"
message. Security logs are set to show failures but have been no help.

Here's some other details:
Forest functional level: Windows 2000
Domain functional level: Windows 2003
O/S: Windows 2003 Server R2, Standard 32 bit edition
VPN connection type: PPTP
RRAS server is a member server, not a domain controller.
User accounts were migrated using the ADMT. There hasn't been any problem
with them so far.

I tried removing / reinstalling RRAS and installing RRAS on a domain
controller - in all cases the results were the same: no problem connecting,
just in accessing network resources.

I'm stumped - any thoughts or suggestions?

Thanks,

Don