Finding GPO policy which set's LocalAccountTokenFilterPolicy to 0 on startup
Solution 1:
Had the same issue. There's a policy called "Apply UAC restrictions to local accounts on network logons" which is set to Enabled. This is under the MS Security Guide template. You may need to add this template (SecGuide.adml and .admx) to c:\windows\policydefinitions from the Templates folder in the Baseline download before you can see it in local group policy
Solution 2:
In order for me to find the policy, I had to run MMC and add-in the Group Policy Object Editor even though my server was off domain