BitLockered clients are not contacting MBAM others are

Question

Hello, I have hundreds of clients that have bitlockered successfully and registered with MBAM but also have hundreds of machines that have encrypted and not checked in with MBAM.
Those that work under the eventlog MBAM -> operation show ids, 1 'applied policy' 19 'registered with MBAM' and 3 'encryption data send'. Those that don’t work only show id 1 'applied policy'.
It’s like the client will not attempt to talk to MBAM. all machines receive the same policy.
Why won’t they check in and how can I force it ??
Before anyone gives the generic answers. Yes i have changed the KeyRecoveryServiceEndPoint and StatusReportingServiceEndpoint to 1 and restarted the service.
By the way im using MBAM 2.0 - standalone not SCCM integrated with a 2 server setup on a single domain.

Answer 1

sure...
error 4 is:
An error occurred while sending encryption status data.
Error code:
0x803d0010
Details:
The remote endpoint was not reachable.
Error 2 is:
An error occured while applying MBAM policies.
Volume ID:\\?\Volume{c0e67f4d-ec35-11e3-8490-f0def17b504b}\
Error code:
0x803d0013
Details:
A message containing a fault was received from the remote endpoint.
Im starting to suspect local firewall. The machines are connected to the network at the time these errors are logged. I have checked i can ping the server from the client machines.