what is the most secure way of deploying domain joined WAP servers in a DMZ?
If you absolutely must have domain joined servers in DMZ, don't put writeable domain controllers in DMZ - only read-only domain controllers. Generally, domain-joined servers in DMZ increase security risks, so in terms of security this should be avoided if possible.
And are there ...
The Windows Authorization Access Group did not have authority to read the tokenGroupsGlobalAndUniversal property on the accounts in question. Theses are the steps I took to fix the issue:
Open Active Directory Users and Computers
Go to the View menu and make sure the Advanced Features option is checked.
Open the Properties for the desired user account.