Yep, think its something I missed in the default domain policy.
Found my GPO backups from the old 2003 DC from before migration about 11 months ago, the basics are there and just need some updating.
Just imported and tested them and they work! countless hours saved and some hair loss averted. only all the user accounts to make and add every pc to the domain now.
Still running most things from scripts which were backed up, but kept the same DC hostname so that should save me some time too!
Time to read up on GPOs again once this is done.