I have a Routing & Remote Access VPN on a W2K server that's been up and fine for years. Generally, I VPN in from various places using the standard Windows client on XP or Vista, and usually then remote-desktop into various systems on that remote LAN.

I have another user I'd like to have access in the same way, but she can only see and access the Win2K serer after connecting through the VPN - no other system on the LAN even responds to ping for her.

I seem to recall a few years ago I had a contractor who I gave exactly that kind of access to - to see the server only, but I don't recall how I did that. But in any case, now I want this user to have the same access that I do, but under her own login credentials of course.

I have a single remote access policy - membership in a group - and she is a member of that group. I have tried giving her administrators group as well (since I have that) but that changed nothing for her LAN access.

I've checked input/output filtering, and there's nothing there about per-user or per-group access (it is just IP, port and protocols filtering anyway).

She is using Vista32 on a laptop - same as I am. She connects and authenticates without a problem. There is no external routing firewall between this server and the LAN. There is no filtering on the LAN interface on the W2K server. She authenticates and is given an IP in the LAN address range (I've checked by looking at the Remote Access Clients in RRAS manager). Note that this is not an AD setup, just a basic MS LAN with a couple of servers and about 6 workstations.

So the question could be asked: If you wanted to give a user VPN access through RRAS and wanted to limit them to just the RRAS server itself for LAN visibility, how would you do it? Or how might I UNDO it?