Terminal Server Access Issue after Switching VPN Service from 2003 Server to 2008 Server

Currently we have 1 Windows 2003 Server running RRAS that handles demand dial client VPN connections.  Once the client makes a VPN connection, they can
then connect to one of two terminal servers (both running Windows Server 2008).  There is no terminal server concentrator or anything fancy like that.  
This Windows 2003 server is also a domain controller (we're aware that running RRAS on DC is not a best practice).  

There is another Windows 2008 R2 server that is a GC and we're trying to move the RRAS service to.  RRAS and the Network Policy Server on the
2008 server appears to be configured correctly. When we switch the RRAS servers over, clients can establish VPN connections without any problem.  However,
they are only able to connect to one of the terminal servers. Things we've verified so far in trying to troubleshoot this:

1. This is not a firewall problem.
2. The network policy (on the new RRAS server) appears to be configured correctly for allowing users access (NAP enforcement has Allow full network access checked)
3. We have a "Terminal Servers" group configured in AD under computers with both Terminals Servers as members. The resource auth policy
   and connection auth policy on both terminal servers is configured exactly the same with the correct users given access to the 
   correct allowed resources (the "Terminal Servers" group)

I'm thinking the configuration issue is likely on the new RRAS server but I feel like I've been over every option and I don't see a place where one terminal
server is being included and the other excluded.  

Hoping someone can give me suggestions for where else to look. Thanks in advance!