Windows Server 2019 does not allow groups to be dumped to APM?

I've two Windows Servers in an environment, configured in av VERY similar way. The domain name is pretty much all the difference, configuration-wise. One is 2012-R2 and one is 2019 180-day eval.

 

In APM, I've added a Active Directory object for each, using the administrator account to connect to AD. adtest passes flawlessly on both. Authentication works fine on both. The 2012 server happily dumps all the groups so I can build APM rules around them, but the 2019 server does not. The log only says:

 

Mar 1 13:04:31 bigip1 err adutil[15208]: 01490200:3: unable to get domain groups for server /Common/dc2019.example.com

 

Anyone else seen this?

 

BIGIP is 13.1.