I'm playing around with a test domain on Windows Server 2012 R2. I'm operating at the highest possible functional level and have no backwards-compatibility issues in my small test environment. However, I've realized that despite the fact that I have support for Kerberos AES authentication, it is not enabled by default for any users. I have to actually go into a user's properties and check off "This account supports Kerberos AES 128 bit encryption" and/or "This account supports Kerberos AES 256 bit encryption" to enable it.
(I first realized this when adding a test account to the "Protected Users" group, which sets policy to require AES. Afterwards, all my network logins started failing until I checked those boxes.)
I figure that this might be disabled by default to ensure backwards-compatibility for some systems, but I can't find a way to enable this for all users, or even an explanation of the current behavior.