when some sccm (configmgr) clients should auto approve and don't

seems to be an issue when the client tries to send data thru the CCM_SYSTEM_WINDOWSAUTH virt dir on the MP.  Keith wrote a doc that explains how client approval should work and also has some troubleshoot tips:

https://blogs.technet.com/b/configurationmgr/archive/2010/01/20/how-it-works-automatic-client-approval-in-configuration-manager-2007.aspx