I am currently setting up an office VPN on a new server (running SBS 2011), and I keep getting "Error 812: The connection was prevented because of a policy configured on your RAS/VPN server..." when I connect with my Windows 7 laptop. However, I have the NPS policy configured to let all users of a certain group connect via VPN and the authentication methods match what the server is looking for. I also have set the NPS policies to honor dial-in access overrides on specific accounts.
XP also errors out when connecting externally, saying that the user does not have VPN privileges (Error 649). Any ideas? Even explicitly giving a user dial-in privileges does not change this.