SCOM 2022 agent in trusted domain issues (two-way forest trust with selective authentication)

Question

Hi, I have two-way forest trust with selective authentication between forest A and forest B. Having installed SCOM 2022 Management Server in forest A and deployed SCOM agents to all servers in the same forest, I have issues with SCOM agents on all servers in the trusted forest B:

Failed to initialize security context for target MSOMHSvc/SCOMServerFQDN. The error returned is 0xC0000413(0xC0000413). This error can apply to either the Kerberos or the SChannel package.

OpsMgr was unable to set up a communications channel to SCOMServerFQDN and there are no failover hosts. Communication will resume when SCOMServerFQDN is available and communication from this computer is allowed.

For security reasons I have to keep two-way forest trust with selective authentication. I guess in case of this type of trust I do not need Gateway Server. Any help would be highly appreciated.

Answer 1

Hi,

Failed to initialize security context for target MSOMHSvc/SCOMServerFQDN. The error returned is 0xC0000413(0xC0000413). This error can apply to either the Kerberos or the SChannel package.

The default configuration on SCOM 2019 Agents, is that service accounts and RunAs accounts will now leverage the “Log on as a Service” user right, and no longer require “Log on locally” user right.  This means that in order for any RunAs account to work, Log on as a Service is now required.

 When you install SCOM 2019, the setup program automatically configures this for accounts you specify during setup.  You can review this by opening the Local Security Policy > Local Policies > User Rights Assignment > Log on as a service:

Security changes in SCOM 2019 – Log on as a Service – Kevin Holman's Blog

 Configuring Selective Authentication for User Profile Migration

  

Answer 2

Still, I am not sure what I should do here.

Answer 3

Based on the description in the above document, we can try to add SCOM service accounts to Local Group for Authentication

• Enable Selective Authentication
• Create a Domain Local Group in the Target Domain
• Set Access Control on "Domain Controllers" OU or a Specific Domain Controller
• Add Source Domain Accounts to Local Group for Authentication

Answer 4

Same errors:

Failed to initialize security context for target MSOMHSvc/SCOMServerFQDN. The error returned is 0xC0000413(0xC0000413). This error can apply to either the Kerberos or the SChannel package.

OpsMgr was unable to set up a communications channel to SCOMServerFQDN and there are no failover hosts. Communication will resume when SCOMServerFQDN is available and communication from this computer is allowed.