...because it's showing up for multiple separate accounts tested multiple times, each of which can log on perfectly well to other machines in the domain, including Windows 10 machines.
This is showing up on a freshly-installed Windows 10 Anniversary Update workstation, joined to a Windows Server 2012 R2 domain. Also eliminated so far:
- dcdiag shows no errors with the domain.
- network connectivity between the workstation and the DC is fine.
- times are properly synchronized.
- the domain users are in the local administrators and users groups on the workstation, both of which groups have the Log on locally user right. (And this applies to all users, including the domain administrator.)
- the NetDebug file shows no errors when joining the machine to the domain. (Either time - removing it and rejoining it had, as expected, no effect.)
- testing the secure channel shows it to be up and working.
- the workstation applies group policy, installs software configured in group policy, etc.
- most confusingly of all, the users can be logged in when I connect to the machine using enter-pssession; just not when logging in on console or through Remote Desktop.
So given all that - what's left?
Additional: another machine installed with the same Windows 10 setup later does work, so it seems to be client-specific.
Additional additional: Starting with an installation of Windows 8.1, adding that to the domain, and then upgrading it to this version of Windows 10 does work.
I have no idea.