Jinxy, yes they are configured for VPN access within AD.

The other thing that is strange is if an older machine is already added to the domain they can login just fine down the VPN tunnel, I just can't add any freaking new machines. Do you know if Unicast or multicast needs to go down the tunnel or what ports other than 135,137139?

Grrrrrr...