受信任域用户无法连接RD网关的故障排查求助

我已经折腾好几天配置RD网关，想让受信任域的用户能正常连接，但一直没搞定。

目前找到的错误日志 #

RD网关的错误记录 #

The user "DOMAIN\login", on client computer "172.22.2.125", did not meet connection authorization policy requirements and was therefore not authorized to access the RD Gateway server. The authentication method used was: "NTLM" and connection protocol used: "HTTP". The following error occurred: "23003".

NPS服务器的日志记录 #

"ServerName","RAS",04/07/2023,11:31:59,1,"DOMAIN\login","DOMAIN\login","UserAuthType:PW",,,,,,,,,,,,5,,,12,7,"-- RDG Marker Policy {985F7B54-FCE8-4f55-AEBF-DF8827A44068} --",0,"311 1 10.239.16.9 04/06/2023 10:04:45 50",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",1,,,,

"ServerName","RAS",04/07/2023,11:31:59,3,,"DOMAIN\login",,,,,,,,,,,,,,,,,7,"-- RDG Marker Policy {985F7B54-FCE8-4f55-AEBF-DF8827A44068} --",65,"311 1 10.239.16.9 04/06/2023 10:04:45 50",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",1,,,,

环境情况和我已经排查过的内容 #

• 域A和域B之间是双向信任关系（查资料说这是RD网关正常工作的必要条件）
• 存在用户账户重复的情况（两个域里有相同SAM账户名的用户）
• 已经检查过网络连通性，确认没问题
• 为了区分本地域和远程域用户，专门创建了单独的连接授权策略（CAP），分开设置用户组
• RD网关服务器已经加入AD的RAS and IAS Servers组
• 连接授权策略（CAP）里确实包含了我测试用的用户所在的组

实在不知道哪里还有问题了，有没有大佬能给点排查方向或者建议？

Regards,
Vincent

备注：内容来源于stack exchange，提问作者KAMI