We recently had a single member 2012 R2 DC which we upgraded in-place to 2019. On every reboot the server would assume the network was "Private" which disabled network rules in the Windows Firewall we had set for the "Domain" profile.

Add the following registry entry to fix this issue, and make the DC stay on the "Domain" profile across reboots:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters
Add DWORD (32-bit): AlwaysExpectDomainController
Set to 1 or dword:00000001