Error 812 when connecting to office VPN

Question

I am currently setting up an office VPN on a new server (running SBS 2011), and I keep getting "Error 812: The connection was prevented because of a policy configured on your RAS/VPN server..." when I connect with my Windows 7 laptop. However, I have the NPS policy configured to let all users of a certain group connect via VPN and the authentication methods match what the server is looking for. I also have set the NPS policies to honor dial-in access overrides on specific accounts.

XP also errors out when connecting externally, saying that the user does not have VPN privileges (Error 649). Any ideas? Even explicitly giving a user dial-in privileges does not change this.

Solution

I found the solution, you have to add users to the Windows SBS Virtual Private Network Users group. NPS doesn't seem to honor a normal usergroup (which is how I had it configured before).