This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 33%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBZ%3C/text%3E%3C/svg%3E)
Hi, since I have a 2-way forest trust with selective authentication between a single-domain forest hosting SCOM 2022 Management Server and a single-domain forest hosting servers I want to monitor, what are detailed steps to perform to get rid of following errors:
Failed to initialize security context for target MSOMHSvc/SCOMServerFQDN. The error returned is 0xC0000413(0xC0000413). This error can apply to either the Kerberos or the SChannel package.
OpsMgr was unable to set up a communications channel to SCOMServerFQDN and there are no failover hosts. Communication will resume when SCOMServerFQDN is available and communication from this computer is allowed.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 92%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXM%3C/text%3E%3C/svg%3E)
Hi,
Could you please share your New Trust configuration? I'd like to test it in my lab.
This domain: A.com
Specified domain: B.com
Direction:
Incoming: Users in the local domain can authenticate in the specified domain.
Trust type: Forest trust
Transitive: Yes
Outgoing trust authentication level: Selective authentication.
Sides of trust: Create the trust for both this domain and the specified domain.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 66%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
Hi,
Other than sticking on the authentication, if possible, we may consider bypassing it, regarding the agent as that in the untrusted domain (workgroup) and install the agent via the certificate. Here's two guides that we can follow:
Monitoring non-domain members with OM 2012
Monitoring untrusted servers using SCOM, a step-by-step guide
Regards,
Alex Zhu