Figured it out - the real problem why it will work on upgraded from 3.3 devices and not work on the clean install 3.4 is the only difference between them - the user folder name - defaultuser for clean 3.4 and nemo for 3.3 upgrades. So, the fix to get spoofing working is to stop AD and create a nemo symlink to defaultuser. 
Of course, if you already have a nemo folder, first move its contents to defaultuser, delete nemo and then symlink it.
9 Likes