error when starting remoteapp program - "the following is not in your list of authorised programms:"

have 2 rd  web servers set up using an nlb cluster
3 rd sesison host servers - dns round robin
session broker (installed on dc)

web single sign on is in place using cert generated internally on standalone ca

I have added several programs to list on all session host servers and allows "domain users" access to them.

regardless of the account that logs on I get the error "the following remoteapp program is not in the list of authorized programs: WordPad

I have tried various things but I am sure the setup is correct.. any ideas?