NPS on SBS 2008 and problem with conditions for computer groups

Hello,

I have SBS with NPS, that authenticate VPN clients.

If I set up condition, that users must be member of specific AD user group to connect, it works ok. But when I want to have one other condition, that also the device, the user is dialing VPN from, is a member of AD computer group it stops working.

In server logs are errors, that user doesn't have rights to connect to the network. (ID 20271)

Is there any special how-to to make working two conditions (first - user is part of specific AD user group, second - computer is part of specific AD computer group)?

Thanks for help

J.Slady