I've configured the below group policy verified that it has applied to the server and gpupdate /force /sync plus a reboot
Computer Configuration\Policies\Administrative Templates\Windows Components\Remote desktop Session Host\Connections\Set rules for remot control of Remote Desktop user sessions: ENABLED, View Session without user's permission
I've also configured the RDP-TCP rights by allowing the built in remote desktop users to have full control, then restarted the server.
When I RDP into the box with a generic account I can only use shadow.exe to mirror it with an admin, the non administrator account that has FULL rights to RDP-TCP gets the below
Remote control failed. error code 5
Error [5]:Access is denied
I've searched around pretty thoroughly, and this should be working. What am I missing?
***EDIT** All boxes in question are 2008 R2 and have good connectivity