I just noticed that my TS has a local group for Remote Desktop Users and there's a domain group with the exact same name. I don't know if this is standard or some clown messed ours up. Either way, make sure what you did from above has the correct group listed (or BOTH groups).