I had this issue before, and it was due to me not using the fully qualified domain name when using VPN.

For example, our domain is xyz but on the controller...