Make sure registry keys for MaxPacketSize is set, and you also have the value set to force Kerberos to use TCPIP.

UDP is the default, which can lead to time out issues (sporadic).

MaxPacketSize is more for users - tickets for groups can sometimes get truncated, so a user (especially when carrying history from an old domain) might experience issues, while other users work fine.