The SELECT permission was denied on the object 'configurations', database 'mssqlsystemresource', schema 'sys' (Error 229)
The answer was in fact the logins being in a AD group account also which I didn't see that they were members of and someone had selected all permissions on the master database so obviously selecting denydbreader/denydbwriter. 

My fault for missing this group out from my checks!