Enable the setting:

Windows Firewall: Allow Remote Administration Exception

This can be found in the GPO Editor (gpedit.msc) in the following path:

Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall\Domain Profile

***Please Note*** If you connect via RAS or VPN you may need to set the exception under Standard Profile as well.

From this location you can also enable the Allow Remote Desktop exception to allow Remote Desktop functionality.