I would like to add to this in case others are having the same issues.  Here is what I had to do:

IE - works by default, leave it alone.

Firefox

1. Navigate to about:config - confirm warning,
2. Search for NTLM, find (if it doesn't exist, create it):
   • network.automatic-ntlm-auth-trusted-uris
     • enter in your servers/domains
     • for multipel values, use comma separated
     • e.g. "server1,server2,domain1.com,domain2.com,*.domain3.com" - without the quotes.  Wildcards are acceptable.
3. Search for Negotiate
   • network.negotiate-auth.delegation-uris
     • enter in same list as #2
   • network.negotiate-auth.trusted-uris
     • same list

Alternatively, you can also make a batch logon script to replace a custom user.js file that should be located in each users' %appdata%\Mozilla\Firefox\Profiles\<ff-uid>.default\user.js

user.js file ::

user_pref("network.automatic-ntlm-auth.trusted-uris", "server1,server2,domain.com,domain2.com,*.domain3.com");
user_pref("network.negotiate-auth.delegation-uris", "server1,server2,domain.com,domain2.com,*.domain3.com");
user_pref("network.negotiate-auth.trusted-uris", "server1,server2,domain.com,domain2.com,*.domain3.com");
user_pref("browser.search.defaulturl","http://www.google.com/");
user_pref("browser.search.defaultenginename","Google");
user_pref("security.warn_viewing_mixed",false);

The last 3 lines in the above code are optional.

Batch file for replacing user.js (e.g. firefox-user-js.bat)::

if exist "%APPDATA%\Mozilla\Firefox" for /D %%F in ("%APPDATA%\Mozilla\Firefox\Profiles\*") do copy /y "\\network\location\of\your\\user.js" "%%F"

insert this to your logon script to call the batch file ::

call "\\location\of\the\batch\file\firefox-user-js.bat"

Chrome

This one for whatever reason took me the longest to figure out because everyone gave the same solution, but it never worked.  If you use Google Chrome variables in HKLM\Software\Policies\Google\Chrome - it wont work (at least it didn't for me).  The only way I got it to work was inserting the keys into the HKCU instead. I used GPMC with item-level targeting as it was readily available and easy for me.  You can export the keys, then use a .reg file and run it at logon as well.  Since I used GPMC, I will provide directions for the item-level targeting.

Here are the steps:

1. Create or modify an existing USER Configuration Policy
2. Traverse to User Configuration > Preferences > Windows Settings > Registry
3. Insert in a new Collection Item (optional)
   • Call it Google Chrome (or whatever you want)
4. Inside the Collection Item, insert new Registry Key - you need two keys

   Key 1 ::
   
   Action: Create
   HIVE: HKEY_CURRENT_USER
   Key Path: Software\Policies\Google\Chrome
   
   Value Name: AuthNegotiateDelegateWhitelist
   (don't check default)
   
   Value Type: REG_SZ
   Value Data: <insert the comma separated list you had for firefox>

   Key 2 ::
   
   Action: Create
   Hive: HKEY_CURRENT_USER
   Key Path: Software\Policies\Google\Chrome
   
   Value Name: AuthServerWhitelist
   (dont check default)
   
   Value Type: REG_SZ
   Value Data: <insert same comma separated list you had from firefox/last key>
   

For item-level targeting, on each key that you create - there is a "Common Tab".

Common Tab - Do this for each key, with their own criteria::

1. Select Item-level Targeting
2. Go into Targeting
3. Add new item > Registry Match
4. Select "is not" from Item Options
5. Fill in the following:

Match Type:
Value exists

Hive:
HKEY_CURRENT_USER

Key path:
SOFTWARE\Policies\Google\Chrome

Value name:
AuthServerWhitelist  // or // AuthNegotiateDelegateWhitelist - whichever key you are working on

Value type:
Any

The total value should say "the registry value HKCU\Software\Policies\Google\Chrome\<key name> does not exist" on each key that you did targeting.

I have tested all of the above on our network and all three browsers are now working the way I wanted it to.  Good luck.