Problems Deploying Ops Mgr Agents in a Trusted Forest

Saw an interesting bit in the Ops Mgr 2007 newsgroups that reminded me of a problem I had in the RC timeframe. Attempts to push install agents were repeated failing. As it turned out, the root of the problem is that, as you may know, agent authentication requires either Kerberos or Certificate-based authorization and we had an external trust in places, which is a problem... As Marc Reyhner, one of the OpsMgr developers stated: "You need to use a forest trust rather than an external trust. Agent to server (inter Health Service) communications requires either Kerberos or certificate based authentication. external trusts do not support Kerberos therefore they do not work for Health Service communication. For Health Service communication we do not support forms of authentication that do not allow for mutual authentication (which includes NTLM)."