Right, we've gotten to the bottom of it...and I'm kicking myself!
There was a Computer Configuration side GPO enabled. Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection - Do not allow smart card device redirection.
GRRRR!!!