I found some help here:
- https://community.spiceworks.com/topic/1389891-windows-10-and-sysvol-netlogon
- https://social.technet.microsoft.com/Forums/en-US/f4d77de7-17df-4463-b751-d1892829e7ab/windows-10-cannot-be-access-sysvol-amp-netlogon-folder-on-the-server-2012-r2?forum=win10itprogeneral
Looks like the SMB security needs to be weakened to allow Windows 10 to access these shares.
Enable the following policy:
- Computer -> Administrative Templates -> Network -> Network Provider -> Hardened UNC Paths
You can either put the following in "Show Values":
- \\*\NETLOGON RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0
- \\*\SYSVOL RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0
Or put an entry for each DC:
- \\DCNAME RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0
