I recently added a development domain into our SCCM umbrella. This domin trusts the main production domain but is not trusted in reverse. So I had to manually install agents because I was unable to do an AD discovery on the systems in this forest. I thought at one time I was able to when i did my initial testing over a year ago. So now that the systems are all in and reporting I tried to send out a Java deployment to them, and it appears that the systems in this forest get stuck at waiting for content. I tried another package that was not a silent mandatory so I could see what was happening and I eventually got the message that the content was unavailable. Do I need to create a DP inside of this forest, or is something else going on here? Any help pointing me in the right direction would be appreciated.

I prefer to have a primary site in remote forests. That would simplify things. Otherwise it's like you are managing workgroup clients. You'd need an SLP for them to find content. They can't use AD. http://technet.microsoft.com/en-us/library/bb694003.aspx John Marcum | http://myitforum.com/cs2/blogs/jmarcum/|

You need to make sure you have the boundaries defined for the clients in the other forest and check the Network Access Account. Often when software will not download it's due to boundaries and the settings in the advertisement.Kent Agerlund | My blogs: http://blog.coretech.dk/author/kea/ and http://scug.dk/ | Twitter @Agerlund | Linkedin: /kentagerlund

This is going to be a problem I think. The systems in the dev domain are on the same 10 net addresses as systems in the production domain. So I can't really setup boundries. Even if I was to do a primary site, which I do not want to do, I'd had a boundry problem it sounds like. I have an SLP on the central site server all ready and when I installed my agent on the dev systems I used this command line. Or at least something close to this...I changed names and site code to be generic here. "\\sccm01.prod.net\sccm client\ccmsetup.exe" /mp:sccm01.prod.net /service SMSSITECODE=001 SMSSLP=SCCM01.prod.net FSP=SCCM01.prod.net CCMLOGLEVEL-0 SMSCACHESIZE=10240

This is going to be a problem I think. The systems in the dev domain are on the same 10 net addresses as systems in the production domain. So I can't really setup boundries. Even if I was to do a primary site, which I do not want to do, I'd have a boundry problem it sounds like. I have an SLP on the central site server all ready and when I installed my agent on the dev systems I used this command line. Or at least something close to this...I changed names and site code to be generic here. "\\sccm01.prod.net\sccm client\ccmsetup.exe" /mp:sccm01.prod.net /service SMSSITECODE=001 SMSSLP=SCCM01.prod.net FSP=SCCM01.prod.net CCMLOGLEVEL-0 SMSCACHESIZE=10240

A client is considered to be within slow/remote boundaries if it is not within any boundaries. So make sure that the advertisement is configured to "download & execute" (or "run from DP") if the clients are within slow boundaries.Torsten Meringer | http://www.mssccmfaq.de

So maybe the first thing I really need to understand here is this. Can systems from a different forest be fully managed if that forest has no Primary Site server in it? We are trying to manage these systems without adding another site and SQL server since it is only 200 crash and burn dev VM's.

You need to make sure you have the boundaries defined for the clients in the other forest and check the Network Access Account. Often when software will not download it's due to boundaries and the settings in the advertisement. Kent Agerlund | My blogs: http://blog.coretech.dk/author/kea/ and http://scug.dk/ | Twitter @Agerlund | Linkedin: /kentagerlund So I thnk maybe you have nailed what my problem is with this setup. The network Access Account can only have one account configured on the computer client agent. Mine is currently setup for my primary forest/domain for the site. Since I do not have a different site code for these dev systems they are trying to use an account that they don't have. I am not sure why we aren't allowed to setup multiple accounts here like we can for client push. It would make things much eaiser I think. Do you guys agree that this would be the crux of my problem, and is there any way to resolve it other then adding a primary site?

Here are some details about the network access account: http://technet.microsoft.com/en-us/library/bb680398.aspx. Clients can be managed in another forest - even without a trust: http://technet.microsoft.com/en-us/library/bb694003.aspx; they have to be treated as workgroup clients then: http://technet.microsoft.com/en-us/library/bb680962.aspx So how is the advertisement configured (especially the "distribution points" tab)? Which (error) advertisement status messages are you experiencing?Torsten Meringer | http://www.mssccmfaq.de

I have found the problem. The devs in this domain tried useing SCCM a while ago themselves. I found that the AD schema was extended and it had entries for a MP that isn't one of mine. I removed those entries from AD and my software distribution problems seem to have been fixed after a gpupdate /force. My only issue now is on about 80 of the 200 systems I seem to be out of compliance with software updates. They seem to just sit at downloading forever. It drives svchost.exe to about 80% while it sits there also. Since it's only 80 out of 200 I am thinking it's got to be something to do with those systems at this point. I am going to try the old WSUS repair method of stopping the service and deleting everything in the SoftwareDistribution folder then restarting and doing a wuauclt.exe /detectnow