Just a quick tip that I haven't seen before
When setting up a user in AD that can only log on to certain PCs, make sure to add your MWG7 to their list of PCs that they can log on to. If you don't they can't authenticate to the MWG.
This one was bugging me for about 3 hours
Hope it helps somebody!