Remember: disable the Windows Firewall on a Domain Controller (at least when you have more than one DC and they need to replicate).
You’d think Microsoft would have made it so that if you configure a server as a DC that the
fully integrated Windows Firewall would be automatically configured to open up the correct ports. Seems like a no-brainer, right??? Geeze.