Having trouble assigning the log on through terminal services right

Running a Windows server 2003 Active Directory running in 2000 functional level.
Comprised of  3 DC's, all W2K3

The problem I am having is this:

I have a W2K3 R2 SP2 member server that is being used as an RDP application server.
I need to use an AD group to give local RDP login rights onto the member server, and restrict the users to only have RDP rights to that particular server.  The users are also required to run in a pre-defined environment running one application.

In the past (different server) this has worked with local accounts inside the remote desktop users group, and assigning the environment details inside the RPD profile settings.

I have tried the following steps to try and make this work, but to no avail.

* Added AD group into the Member servers "Remote desktop users group"
* Created an OU and moved the RDP member Server into it.  
* Created a Domain Local Security group containing the necessary Domain Global security group in the new OU
* Created a GPO to allow the log on through through terminal service right, and applied to this OU
   GPO contains: windows settings-> Security Settings-> Local Policies -> User Rights Assignment -> Policy= "Allow log on through Terminal Services": Policy settings= "My Domain Local Security group containing the Domain Global security group "

This is from the Member server application log:
"Security policy in the Group policy objects has been applied successfully."

Unfortunelty I am still getting the error message:

" To log on to this remote computer, you must be granted the Allow lon on through Terminal Services right. By default, members of the Remote Destop Users group have this right.  If you are not a member of the Remote Desktop Users group or another group that has this right, or if the Remote Desktop User group does not have ths right, you must be granted this right manually. "

It also seems that I can't RDP to the server as Domain\domain admin, or Local admin same result

Security Event log from  the memeber server shows:

Logon Failure:
       Reason:      The user has not been granted the requested
             logon type at this machine
       User Name:      Username
       Domain:            Domain-Name
       Logon Type:      10
       Logon Process:      User32  
       Authentication Package:      Negotiate
       Workstation Name:      HOSTNAME
       Caller User Name:      HOSTNAME$
       Caller Domain:      Domain
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID:      3808
       Transited Services:      -
       Source Network Address:      xxx.xxx.xxx.xxx
       Source Port:      2010


Other Variables:
The Member server is running on VMware ESX 3.5
Member server firewall is turned off
Remote desktop is enabled on this member server