Enrolling to WDE with locked down AD Account

Basically, the scenario we're in is that we have a selection of AD accounts that have been locked down to only be allowed to login to a specific machine using "Log On To" e.g. PC1, PC2, PC3. This prevents them logging in to PC4, for example.

Initially we found they could not access the internet anymore as authentication against the proxy/web filter would fail. Adding the IP/hostname of the proxy to Log On To resolved this.

However, this same solution doesn't work when enrolling to the Universal Server, which constantly throws an Authentication Failure error, as recorded by the Universal Server.

Anyone come across this before? Any thoughts?

Thanks in advance!