Setting up WDS on a 2012 R2 DC. Clients can download boot file, but fails on entering credentials needed to access image share. Did Shift-F10 and at X: prompt did NET USE W: \\WDS\REMINST /user:... [password] This fails with system error 50. I can ping WDS OK. Booting WinPE from CD produces same result. But doing NET USE W: \\somePC\someshare /User:[same] [password same] connects fine to any other domain client on LAN. Connection fails to 2nd DC too, so it's just the DCs it won't connect to. Domain-connected clients can connect to DC shares including REMINST OK; it's the PXE clients that can't. Where do I go from here? The DC event log shows 4653 IPsec error, but others report that this is not a show-stopper, just an irritation.
I have no idea how the setting got there, but by comparing a WDS that worked with the problem one, I saw that in Local Security Policy (not the GPO), there was a setting in Local Policies -> Security Options: "Network Security: Restrict NTLM: Incoming NTLM Traffic" that was stopping it working. I changed it from "Deny all accounts" to "Allow All Accounts" and we are back in business.