The fix was to enable Compatibility mode 7 for the timecards website. They'd tried this, but it didn't apply properly in their testing.
To get it to apply properly...
- a.) Enter only the hostname and fqdn in the GPO setting.
- Note: Do not enter the URL. It will not work. Hostnames or FQDN ONLY.
- b.) Apply the setting to the Computer Object, not the User Object.