Hi all：
We have about 50 forwarders that didn't join domain. I followed the steps of the article(http://technet.microsoft.com/en-us/library/hh872886.aspx) to configure certificates, create computer accounts for these workgroup servers and the name mapping also.
And there is only one forwarder can not connect to the collector. I have uninstall/reinstall the scom agent. The health service works fine. But when I enable audit collection on scom console, it gives a 4369 event on the forwarder.
Since the audit collection service is still not working, I enabled debug logging on the server in problem, and the log is showing like this:
[20140410 112149,294][Info ]ReadEventLogLoggingLevel(): The eventlog logging level is 0x00000002
[20140410 112149,294][Debug ]AgentRun(): Waiting for 54402 ms.
[20140410 112153,576][Info ]AgentLdr: ServiceCtrlHandler(0x19B4): trying to exit...
[20140410 112153,576][Debug ]IoContext(0x8A4E80)::Reference(AgentClient::SendNotifyV2): m_lRefCount = 0.
[20140410 112153,576][Warning]ReportCollectorEvent(): SendNotifyV2() returned 0x000004CD.
[20140410 112153,576][Info ]AgentRun(): Wait: Stop event received.
[20140410 112153,576][Info ]AgentRun(): Run(0x2638) exits with 0x00000000.
[20140410 112153,576][Info ]AgentLdr: ServiceMain(0x2638): AdtLdrRun() returned 0x00000000.
[20140410 112159,029][Info ]*** Agent starting up ***
[20140410 112159,029][Info ]AgentLdr: ServiceMain(0x1B70).
[20140410 112159,029][Debug ]AgentLdr: LoaderTask 'EvtLogStartup' completed successfully.
[20140410 112159,029][Info ]ReadEventLogLoggingLevel(): The eventlog logging level is 0x00000002
[20140410 112159,029][Debug ]AgentLdr: LoaderTask 'InitializeState' completed successfully.
[20140410 112159,029][Debug ]AgentLdr: LoaderTask 'OpenProtocol' completed successfully.
[20140410 112159,029][Debug ]AgentLdr: LoaderTask 'IdentifyVersion' completed successfully.
[20140410 112159,029][Debug ]AgentLdr: LoaderTask 'LoadCertificate' completed successfully.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'OpenPackage' completed successfully.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'CreateQueueHi' completed successfully.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'CreateQueueLo' completed successfully.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'OpenReader' completed successfully.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'OpenIocp' completed successfully.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'CreateAgentSrv' completed successfully.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'OpenAgentSrv' completed successfully.
[20140410 112159,107][Debug ]IoServer(0x8A41D8)::AcceptThread() started.
[20140410 112159,107][Info ]IoServer::Run(0x2010): Worker thread starting up.
[20140410 112159,107][Debug ]AgentLdr: LoaderTask 'OpenConnection' completed successfully.
[20140410 112159,107][Debug ]AgentRun(): Entering Run function.
[20140410 112159,107][Debug ]AgentRun(): Waiting for 0 ms.
[20140410 112159,107][Debug ]AgentRun(): Wait: Timeout.
[20140410 112159,107][Debug ]StringToServerDesc(): input: OURCOLLETCOR.FQDN
fqdn: OURCOLLETCOR.FQDN
port: 51909
priority: 0
weight: 100
[20140410 112159,107][Info ]LookupServersReg(): Found OURCOLLETCOR.FQDN:51909.
[20140410 112159,107][Debug ]Connection attempt to server OURCOLLETCOR.FQDN:51909.
[20140410 112159,263][Debug ]IoConnectCtxt::IssueConnect(0x8A4E18): Creating Socket for context 0x8A4E80.
[20140410 112159,263][Debug ]IoContext(0x8A4E80)::InitRefCount(IoContext::Connect): m_lRefCount = 0.
[20140410 112159,263][Debug ]IoContext(0x8A4E80)::Reference(IoContext::InitRecv): m_lRefCount = 1.
[20140410 112159,279][Debug ]SspiPackage::OpenPackage(): fCapabilities: 0x000107B3 cbMaxToken: 16384 wRPCID: 14 Name: Microsoft Unified Security Protocol Provider
[20140410 112159,279][Debug ]CertPackage::InitializeSecurityContext():
recv: 0
send: 77
flags: 0x0000C89E
result: 0x00090312
spn: AdtServer/OURCOLLETCOR.FQDN
[20140410 112159,279][Debug ]IoContext(0x8A4E80)::Reference(IoContext::Send): m_lRefCount = 2.
[20140410 112159,279][Debug ]IoContext(0x8A4E80)::Dereference(IoContext::OnSendComplete): lRefCount = 2.
[20140410 112159,279][Debug ]CertPackage::InitializeSecurityContext():
recv: 2130
send: 1334
flags: 0x0000C89E
result: 0x00090312
spn: AdtServer/OURCOLLETCOR.FQDN
[20140410 112159,279][Debug ]IoContext(0x8A4E80)::Reference(IoContext::Send): m_lRefCount = 2.
[20140410 112159,279][Debug ]IoContext(0x8A4E80)::Dereference(IoContext::OnSendComplete): lRefCount = 2.
[20140410 112159,294][Debug ]CertPackage::InitializeSecurityContext():
recv: 47
send: 0
flags: 0x0000C89E
result: 0x00000000
spn: AdtServer/OURCOLLETCOR.FQDN
[20140410 112159,294][Debug ]SspiPackage::QueryPackageInfo(): fCapabilities: 0x000107B3 cbMaxToken: 16384 wRPCID: 14 Name: Schannel
[20140410 112159,294][Debug ]IoContext(0x8A4E80)::Reference(IoContext::Send): m_lRefCount = 2.
[20140410 112159,294][Error ]IoContext(0x8A4E80)::OnRecvComplete(): Disconnecting: dwIo = 0, dwError = 0x00000000.
[20140410 112159,294][Debug ]IoContext(0x8A4E80)::Disconnect(0x00002746, IoContext::OnRecvComplete): m_lRefCount = 3.
[20140410 112159,294][Debug ]IoContext(0x8A4E80)::Dereference(IoContext::OnSendComplete): lRefCount = 2.
[20140410 112159,294][Debug ]IoContext(0x8A4E80)::Dereference(IoContext::Disconnect): lRefCount = 1.
[20140410 112159,294][Warning]IoContext(0x8A4E80)::OnRecvComplete(): Disconnecting.
[20140410 112159,294][Debug ]IoContext(0x8A4E80)::Dereference(IoContext::OnRecvComplete): lRefCount = 0.
[20140410 112159,294][Debug ]IoContext(0x8A4E80)::Dereference(IoContext::OnRecvComplete): lRefCount = 0 (disconnect complete).
[20140410 112159,294][Error ]AgentClient::Connect(): Connection status 0x00002746.
[20140410 112159,294][Warning]ConnectToServer(): Calling Disconnect() with error 0x00002746.
[20140410 112159,294][Debug ]AgentRun(): Waiting for 20 ms.
[20140410 112159,326][Debug ]AgentRun(): Wait: Timeout.
[20140410 112159,326][Debug ]ReportConnectionFailure().
[20140410 112159,326][Debug ]AgentRun(): Waiting for 5155 ms.
Any idea? The steps I performed have nothing different with other forwarder which works fine.
What can I do to isolate the problem?