Windows Command Line – Grant Dial-In Network Access Permission to Local Account

A little known one is

getmac

It shows the MAC address(es) of your network adapter(s).

In the VPN settings in RRAS, you can change the policy to check that users are a member of a domain security group. Then you can simply add users and groups to give access. Everyone else is denied.

OUs are organisation units. Security groups allow access to resources. They serve different purposes. Sometimes it would be nice to treat OUs and groups the same but they arn't and it usually means that you are using them in a way that isn't as MS intended (which usually causes other problems later)

I'm not in front of an RRAS server so I can't detail the exact options, but I'll update this answer later if nobody else comes up with the steps.

Addn: Create a security group. Make sure users have 'Control access through Remote Access Policy' option selected on their Dial-in tab in Users and Computers. In Routing and Remote Access add a new remote access policy, and add to that conditions NAS-Port-Type matches 'Virtual (VPN)' to apply this to VPN connections and Windows-Groups matches 'DOMAIN\Group' substituting your domain and the new group.