I've been searching for a solution for this myself and finally got it working! I'm sharing in hopes that I can save someone hours of frustration.... It appears that the order in which you enable the policies makes a difference. No kidding. Here's what I finally ended up with in the GPO:
User...