Our company were also getting this problem when trying to use windows RA instead of Citrix shadowing on Win2008 x64 R2 RDC server.
Apparently PKI and encryption have trouble with temporary profiles since the secrets cannot be persisted (in the profile), this can be fixed by modifying the state key on the profile list:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\\State (REG_DWORD) = 0
Note that Windows 2008 doesn’t do the encryption check; it seems to be something added to R2 only.
We are to add this to a logon script for all users, so we can RA to their Citrix sessions.
Hope this helps
