Can't login over VPN network

The domain AAA is in Chicago in subnet 10.10.1.x, and is
linked via router-to-router VPN to an office in
Philadelphia with subnet 10.10.2.x. When I attempt to log
into the AAA domain from a Windows XP workstation in the
Philadelphia office, I get "The local policy of this
system does not permit you to login interactively". Since
the domain controller and other resources (e.g., Exchange)
are in Chicago, users in Philadelphia must be able to log
in. Can anyone tell me what the problem is, and/or how to
fix it?

FYI: the link between the offices appears to be stable; I
can use Terminal Services to access servers in Chicago.