RD Gateway: "User not allowed to logon at this computer" error

Hi,
Probably a silly misconfiguration on my side, but I'm going to ask anyway :)

I have a Win 2008R2 server configured as an RD Gateway.
I have created two new users, Agent1 and Agent2. They are members of the Domain Users group.
I have also created a Global Security group called "Agents" and added the users Agent1 and Agent2
Agent1 and Agent2 are members of the Remote Desktop Users and Power Users groups on the target server TARGET (Windows 2003) and can both RDP in locally without any issues

I have a single RDCAP which allows Domain Users and Domain Admins access.
I have an RDRAP which grants members of "Agents" access to an RD Gateway Managed Group "Agent Servers" which has the TARGET server in it (both as short and full dns name)

Now the problem.

Domain admin users can log in through the Gateway
Agent1&2 can both log in locally using RDP but not through the Gateway
I get the error message on the gateway: User not allowed to logon at this computer.

Any ideas what I have forgotten to configure?

Thanks,
Adam