Have you had any luck in the past six months in getting this to work? It seems like it should be pretty straight forward and I'm quite surprised it's so difficult as well.
I have since upgraded to 4.6 but stil ldid not find an "easy" way to create this report. I opted for another route. I tag my systems using a server task except for those that are imported via Active Directory. Anything that is imported via Active Directory is auto tagged.
As part of the Server Task I also populate the 1st Custom Property field with the TAG information. For example for Servers I would put SERVER in the Custom property field. I was able to create a query based on tags using the custom property field as this is a selectable option and TAG is not. Hope that helps.
I agree with stscott as well, I was just trying to do this and it just isn't simple. I'm trying to cleanup unused tags since it takes forever to get into the Tag Catalog.