Actaully, I didn't modify the GPO since it would impact hundreds PCs. I do have remote admin enabled on the problem machines. Actually, I manually enabled it by using the script you recommended in the post. http://www.lansweeper.com/forum/yaf_postst2967_Scan-over-VPN.aspx.
But most of our PCs have remote admin disabled and the active scan is working fine with them.