Site Server - Client comminucations with selective authentication

Question

My environment has multiple domains, but I've been trying to avoid standing up an MP in each.  Currently the only MP is the site server in domain1.  A two-way selective authentication trust exists between the domains, users and computers from domain2
have 'allowed to authenticate' permissions on the site server and, for the most part, everything is peachy.  However, this has been showing up in the CcmMessaging.log:
IsSslClientAuthEnabled - Determining provisioning mode state failed with 80070005. Defaulting to state of 448.
[CCMHTTP] ERROR: URL=https://SCCM2012.DOMAIN1.com/ccm_system_windowsauth/request, Port=443, Options=448, Code=0, Text=CCM_E_BAD_HTTP_STATUS_CODE
Raising event:
instance of CCM_CcmHttp_Status
    ClientID = "GUID:60A1F0BE-B65D-4F33-9CFE-B15FDE62517F";
    DateTime = "20120919152518.415000+000";
    HostName = "SCCM2012.DOMAIN1.com";
    HRESULT = "0x87d0027e";
    ProcessID = 2480;
    StatusCode = 401;
    ThreadID = 3940;
Successfully sent location services HTTPS failure message.
Post using DOMAIN2\user security context failed due to Integrated Windows Authentication failure
Post to https://SCCM2012.DOMAIN1.com/ccm_system_windowsauth/request failed with 0x80070005.
OutgoingMessage(Queue='mp_[http]mp_policymanager', ID={D6399C84-F0DE-46BD-8630-D918ECA157A5}): Will be discarded (0x80070005).
I'm not exactly sure what these errors are telling me.  First, "Determining provisioning mode state failed"?  I'm actually seeing that on clients in the same domain as the site server, as well.  What is the client attempting to do here, and
in what security context, that it would be getting an access denied error?
Second, the other 5 lines?  I'm assuming that's coming from IIS?  What permissions need to exist that would not be implicit for the second domain?

Answer 1

Yes, I know this is an old post, but I’m trying to clean them up. Did you solve this problem, if so what was the solution?
Since no one has answer this post, I recommend opening  a support case with CSS as they can work with you to solve this problem.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ