Why won't my deployment group agent connect to the server? - azure-devops

Question

I'm trying to provision a deployment group agent (vsts-agent-win-x64-2.170.1.zip) on a lab machine for an on-premises DevOps server. The registration script successfully completes, the VstsAgentAService runs, and I can see the agent in the deployment group (the machine is present and all the Capabilities are visible) but it appears Offline.
Even though the script was clearly able to communicate with the server to provide the Capabilities, things break down when it's the agent's turn.
Event Viewer (VstsAgentAService):
2022-05-16 18:19:32Z: Agent connect error: An error occurred while sending the request.. Retrying until reconnected.
_diag log:
[2022-05-16 18:15:59Z INFO VisualStudioServices] Starting operation Location.GetConnectionData
[2022-05-16 18:15:59Z WARN VisualStudioServices] Attempt 1 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:15:59Z WARN VisualStudioServices] Attempt 1 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:15:59Z WARN VisualStudioServices] Attempt 1 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:16:10Z WARN VisualStudioServices] Attempt 2 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:16:10Z WARN VisualStudioServices] Attempt 2 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:16:10Z WARN VisualStudioServices] Attempt 2 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:16:23Z WARN VisualStudioServices] Attempt 3 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:16:23Z WARN VisualStudioServices] Attempt 3 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:16:24Z WARN VisualStudioServices] Attempt 3 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The operation will be retried[...]
[2022-05-16 18:16:40Z ERR VisualStudioServices] Attempt 4 of GET request to https://[url] failed (WinHttp Error: ERROR_WINHTTP_SECURE_FAILURE). The maximum number of attempts has been reached.
[2022-05-16 18:16:40Z INFO VisualStudioServices] Finished operation Location.GetConnectionData
[2022-05-16 18:16:40Z INFO AgentServer] Catch exception during connect. 4 attempt left.
[2022-05-16 18:16:40Z ERR AgentServer] System.Net.Http.HttpRequestException: An error occurred while sending the request.
---> System.Net.Http.WinHttpException (80072F8F, 12175): Error 12175 calling WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, 'A security error occurred'.
This is when I run the registration script with authentication type: negotiate. If I instead run the script using PAT, it fails right off the bat.
config.cmd:
Enter authentication type (press enter for PAT) >
Enter personal access token > ****************************************************
Error reported in diagnostic logs. Please examine the log for more details.
- C:\dev\azagent\_diag\Agent_20220516-174740-utc.log
TF400813: Resource not available for anonymous access. Client authentication required.
_diag log:
[2022-05-16 17:55:48Z WARN VisualStudioServices] Basic issued token provider instance 52136803 requires an interactive prompt which is not allowed by the current settings
[2022-05-16 17:55:48Z ERR VisualStudioServices] GET request to https://[url] is not authorized. Details: VS30063: You are not authorized to access https://[url].
[2022-05-16 17:55:48Z INFO VisualStudioServices] Finished operation Location.GetConnectionData
[2022-05-16 17:55:48Z INFO LocationServer] Catch exception during connect. 4 attempt left.
[2022-05-16 17:55:48Z ERR LocationServer] Microsoft.VisualStudio.Services.Common.VssUnauthorizedException: VS30063: You are not authorized to access https://[url].
If I go to the URL with Chrome (and enter my credentials), it dumps a bunch of "authenticatedUser" information. Clearly the server is happy with my credentials.
Does anyone know what's going on? What am I missing to make the sever recognize the agent beyond the initial registration?