RDWeb Access and RemoteApp keep asking for logon only outside of network

Hello,

I have installed a brand new 2008 R2 SP1 enterprise 64bit edition and did all the windows update. My AD is managed by 2003 servers.

This server is setup to be a terminal server with RD Web Access, Gateway, Licensing and Session Host. Also, it has Print Server and LDP Service installed. I have also Remote Network Policy setup. I left all the default options.

I did generate my own certificate from that server and if I install it on my client computer under the trusted section, it does say anything about having a certificate issue.

From my network, I can RDP, RD Web Access and RemoteApp to it without any issue at all.

From outside my network without using a VPN, I can see and login to the RD Web Access page and see the RemoteApp icons. When I click on the RemoteApp (any of them) I get prompt with a logon window and I under the same credential I used to enter RD Web Access. After a while it will prompt again the same logon window, I try again and again after a while it will ask for credential.

I have the exact same behavior from a Windows XP Pro (setup as a workgroup only) machine and a Windows 7 Home Premium.

I have looked all over the Internet and it's similar to http://social.technet.microsoft.com/Forums/en/winserverTS/thread/1da9cd90-80f4-4087-9edf-2d9cfa1d312f but I don't have exchange setup on it, so the solution is not applicable... it's not the exact same problem but it's the same behavior.

I also modified the js file for RD Web Access, but that didn't help.

When I look at the events, I can see under security that the user is being logged on when clicking on teh REmoteApp and providing credential, but gets logged off right after that:

An account was logged off.

Subject:
	Security ID:		MYDOMAIN\test
	Account Name:		test
	Account Domain:		MYDOMAIN
	Logon ID:		0x12964b5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

I also got that warning after I installed the roles:

Installation succeeded with warnings. 

Roles:

Network Policy and Access Services
   The following role services were installed:
   Network Policy Server
   Informational: You can use a wizard in the NPS console to configure Network Access Protection (NAP). To open the NPS console after installation, go to Server Manager or click Start, Administrative Tools, Network Policy Server.

Remote Desktop Services
   Warning: This license server is not registered as a service connection point (SCP) in Active Directory Domain Services (AD DS). The license server will not appear in the list of known license servers in the Remote Desktop Session Host Configuration tool. To register the license server as an SCP in AD DS, use Review Configuration in the Remote Desktop Licensing Manager tool.
   Warning: RD Web Access requires additional configuration. On the Configuration page of the RD Web Access Web site, you need to specify the source that will provide the RemoteApp programs and desktops that will be displayed to users. For more information, see <a href="ts_remoteprograms.chm::/html/e1e047ce-d080-4568-b987-378fef46bea2.htm">Configuring the RD Web Access Server</a>.  
   The following role services were installed:
   Remote Desktop Session Host
   Remote Desktop Licensing
   Remote Desktop Gateway
   Remote Desktop Web Access
   Warning: Ensure that your RD Session Host servers are correctly configured to use this license server. For more information, see <a href="ts_license.chm::/html/7cd57119-808e-4777-ab21-1f75a718c1ad.htm">Configure License Settings on an RD Session Host Server.</a>
   Informational: <a href="ts_admin.chm::/html/21ea97a1-a75d-4ff6-87b1-faab342050a4.htm">Enable Windows 7 features on this RD Session Host server by using Desktop Experience.</a>
   Warning: Use the Remote Desktop Session Host Configuration tool to specify a Remote Desktop license server for this RD Session Host server to use. For more information, see <a href="tscc.chm::/html/fed1c160-dde3-49d5-a54f-a4e7a39f1695.htm">Configure License Settings for an RD Session Host Server</a>.

Web Server (IIS)
   The following role services were installed:
   Web Server
      Common HTTP Features
         Static Content
         Default Document
         Directory Browsing
         HTTP Errors
         HTTP Redirection
      Application Development
         ASP.NET
         .NET Extensibility
         ISAPI Extensions
         ISAPI Filters
      Health and Diagnostics
         HTTP Logging
         Logging Tools
         Request Monitor
         Tracing
      Security
         Basic Authentication
         Windows Authentication
         Client Certificate Mapping Authentication
         Request Filtering
      Performance
         Static Content Compression
   Management Tools
      IIS Management Console
      IIS 6 Management Compatibility
         IIS 6 Metabase Compatibility

Features:

Remote Server Administration Tools
   The following features were installed:
   Role Administration Tools
      Web Server (IIS) Tools

RPC over HTTP Proxy

My license server has been setup after the installation of the roles, it's working and seen my the Session Host. Also I setup RemoteApp and I can see them when I login to RD Web Acccess.

Can you help me figure out how to fix my login from outside my network?

Regards,

Yael