Server 2016 RDP User account not authorized for remote login.

Hello,

I have a problem with new active directory user accounts on a Server 2016 VM, RDS, Session Host, Connection Broker, Licensing Mgr, joined to an Active Directory domain.  All other existing accounts are set up the same way and work fine.  The new ones give:

Here's how things are set up:

The DemoUser account is a member of the Demo Users security group:

Here's the Demo Users group general tab:

This shows the Demo Users group is a member of the RD Users group:

Everything I've read tells me the user should be able to connect.   Please help!!!