I recently ran into this issue and am having trouble tracking down the cause. From my Win10 workstation, I normally run Config Manager Console using a RUNAS with an elevated access account that has full admin rights to domain workstations. When I run a command from the latest version of RCT 2.5.6334.19976 from the console, such as "refresh machine policy" on a collection, I receive "Access Denied" messages on the majority of the computers.
Executing the same action from the SCCM server, with the same version of Confg Mgr Client and RCT works fine. The only difference being that I am logging into the server with the elevated access account, instead of executing config mgr with the elevated account as "runas". It appears that the tools are not using the credentials used when executing the Config Mgr Console.
How do i get around this behavior?