I remember having this problem when Server 2012 R2 had just come out, but after searching online, I managed to solve it through some magical combination of GPO settings. Now we have a few Server 2016 ...