Windows NT, Windows 2000, and Windows 9x clients that try to establish a PPTP session with a Windows 2000 PPTP server receive:

Error 649
Login failed: username, password, or domain was incorrect.
At the same time, the server's event log receives:
Event ID 20078
The account for user connected on port VPN3-127 does not have Remote Access privilege.
The line has been disconnected.

Event ID 20189
The user connected from x.x.x.x but failed an authentication attempt due to the following reason:
The user tried to connect using an unauthorized dial-in media.
To fix this problem:

1. Start the Routing and Remote Access administrative tool.

2. Expand the options under your Remote Access Service (RAS) server's name.

3. Press Remote Access Policies, right-click, and press Properties on Allow access if dial-in permission is enabled.

4. Press Edit Profile.

5. On the Dial-in Constraints tab, do one of the following:

Clear the Restrict Dial-in Media option.

              -or-

Select Restrict Dial-in Media, and then select Ethernet and VPN from the list of options available.
6. Press Apply.

7. Press OK.