We replaced one of our old 2008 domain controllers with 2012 a few weeks ago. Today we found some odd behaviour in trying to access the internet from the new DC. It seemed that sometimes it worked, sometimes it didn’t. For one user (logged on locally) it worked for another it wouldn’t.
After some head scratching it turned out we’d fallen over the “GlobalQueryBlockList”