Locked the keys in the car, eh?
I don't believe that one is configurable via Group Policy. Periodic policy refresh isn't going to help you run a script or install software on the machine since both of those operations only occur on a synchronous policy refresh (i.e. a reboot).
I think you're going to be stuck laying hands on the machine.
I've forgotten what the static packet filter that gets added by that wizard contains. Something in the back of my mind says its fairly restrictive and might even limit the machine's ability to contact AD for a Group Policy refresh.
Assuming it can access AD for Group Policy and, if you can get somebody to reboot it, you can assign a Powershell startup script with the commands Get-RemoteAccessIpFilter | Remove-RemoteAccessIpFilter
that will probably do the trick (though I don't have a test box spun up right now to verify with).