Domain – Add a domain user to the Administrator group of a WORKGROUP machine not joined to the domain

I saw this once before. All of the tests you ran worked, but it still couldn't pull down the group policies. NSlookup worked just fine, it could talk to and resolve the DCs just fine. And yet, no policies.

What ended up being the problem was the "TCP/IP NetBIOS Helper Service" was turned off for some reason. This setting came from the image, as it happened, so the image had to be re-baked, but it worked just fine once enabled.

I've found the cause, and it's none other than our dear friend UAC.

I stumbled on this by experimentation, after recalling that (depending on settings) UAC will prompt members of the Administrators group for privilege elevation, while the built-in Administrator gets automatic elevation without prompting. This led me to wonder if it was an issue with prompting a remote user.

I found that with UAC disabled, everything started to work as expected.

Unfortunately, there does not appear to be any setting that allows these things to work with UAC enabled. I tried all the UAC-related policy settings (such as "elevate administrators without prompting") in case they might solve my issue as a side-effect, but found no joy there.

I've just booted up a 2008R2 server to double-check what I said in the question about earlier versions, and it is indeed the case that with UAC enabled, it allows the access in question from the same UserA on WorkstationA.

So it seems this behaviour has changed in 2012 or as a result of an update.

So I have an answer, but no solution yet. I do not intend to mark this answer as accepted.