Cannot remote control clients in another domain

Question

Hi,
I have successfully rolled out SCCM 2012 clients with SCEP to machines in our current domain but I now need to do the same to another domain (in a two way trusted forest/domain). I can install the clients without any issue (by adding the DNSSUFFIX argument
to the client push so it can find it's way home), and they are reporting back in successfully including inventories.
However I cannot remote control any of these clients from the console, I've added a domain admin account (from the trusted domain) as a viewer and I've added the Windows firewall exceptions in the agent details. I can get to these clients without any
issues, tracert is fine so I know the routing is good.
If I try and connect I get the generic "Cannot connect to computer" (after "initiating security handshake"), if I do it direct from the Remote Control client I can remote control the client after dismissing the warning "Remote computer
identity cannot be identified". But I understand that this uses NTLM rather than Kerberos.
What have I missed ? I had all this working in SCCM 2007 without any issues so pretty sure the underlying infrastructure is sound.
Any help gratefully received and thanks for taking the time to read this.
Brian.

Answer 1

Thanks everyone for taking the time to reply - I'll put this is the one reply it's easier !
@Jason
Interesting about the DNSSUFFIX thing, there are DNS forwarders back to the domain and it seems to find its way home. When I had SCCM 2007 I used the SMSSLP parameter for the client install, I can't do that in SCCM 2012 hence the DNSSUFFIX parameter.
CmRcViewer.log has been very helpful, I didn't know that one existed - I guess I have some kind of lookup issue going on ;
Address Lookup failed for the target host: WSUSTEST.
No such host is known. (Error: 80072AF9; Source: Windows) CmRcViewer 03/12/2014 11:40:52 13048 (0x32F8)
Address Lookup failed for the target host: WSUSTEST.
No such host is known. (Error: 80072AF9; Source: Windows) CmRcViewer 03/12/2014 11:40:52 13048 (0x32F8)
Failed to connect to remote system. This can be caused by several conditions: system is turned off, system cannot be reached, windows firewall blocks TCP Port 2701, or remote control feature is disabled. CmRcViewer 03/12/2014 11:40:53 13048 (0x32F8)
Sending 'Remote Control session failed to start' status message for session with remote system WSUSTEST CmRcViewer 03/12/2014 11:40:55 13048 (0x32F8)
@NolanC
The issue is from the console - I can connect via FQDN or IP but get the warning "The Remote computer identity cannot be verified".
@Joyce
See the extract above, thanks for pointing me towards this log. I can confirm that the correct Firewall exceptions are in place and the membership of the ConfigMgr Remote Control Users reflects the permitted viewers in the client settings.
Just seeing if I can resolve the lookup issue, DNS seems to fine ! Unless I've missed something in SCCM.