Mike - I am traveling with no access to any of my SSL documentation. But from memory you need to do the GINA integration to achieve this. Did you look into that?
By enabling gina on the role you can accomplish the requirement.
By enabling gina users will have the same feel as in lan.
Group policy, mapped drives all this can be updated on the workstation.
Please refer the following KB for configuring Gina
* please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks
rexpgp is correct: users must already have an account for GINA. logoffonconnect may not work either unless you login as that user initially