It only happens on Server 2012 R2 when "Desktop Experience" is enabled and you're logged-on with an account that would have groups stripped from its token by User Account Control.

I've no doubt it's related to UAC, ultimately, but I've nearly reached the breaking point w/ my disgust with being unpaid outsourced QA for Microsoft. Deploying and supporting their products have been my livelihood for 20 years, but the "new Microsoft" in the Windows as a Service era is straining my ability to recommend them.