As an update:
I THINK ive resolved this….wasnt PfSense causing this at all, it was TMG.
"strict RPC compliance" was on. Turn it off, and thus far, works fine, as well as fixing a few other minor issues which i assume use RPC or DCOM.
Im still testing but it'll be hilarious if a protocol that MS products rely on to work, is "broken" by a MS product too. :p