Thanks for your help - I found the issue. Someone had disabled permissions inheritance on the sub OU. The lack of system permissions being applied was creating issues. I hope this helps someone in the future.
-- Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
