Cleber,
Hoje encontrei a solução para o problema. Basta configurar o ServicePrincipalName (SPN) no registro do AD utilizando a ferramenta ADSIEDIT ou o comando setspn. Depois que eu fiz isso os servidores SCCM e SCOM se integraram e eu pude habilitar o recurso de PRO sem precisar alterar as contas de serviço;
Segue o procedimento:
Set the Values for the SPN
For the Health Service, use either ADSIEdit.msc or SetSpn.exe to add the following values to the servicePrincipleName attribute of computer object of the RMS cluster, RMS:
¾ MSOMHSvc/RMS.xxxx.com
¾ MSOMHSvc/RMS
For the SDK Service use either ADSIEdit.msc or SetSpn.exe to add the following values to the servicePrincipleName attribute of user object of the SDK and Config Service Account, SDK_Account.:
¾ MSOMSdkSvc/RMS.xxxx.com
¾ MSOMSdkSvc/RMS
Using ASDIEdit.msc
To use ASDIEdit.msc, browse to the object and go to its Properties. Go to the servicePrincipleName attribute and Add the values above.
Using SetSpn.exe
To use SetSpn.exe, use the following commands:
SetSpn.exe -A MSOMSdkSvc/rms (fqdn) domain\SDK_Account
SetSpn.exe -A MSOMSdkSvc/rms (netbios) domain\SDK_Account
Verify the SPN Values
To verify that the values have been set, use ASDIEdit.msc or the follow LDIFDE commands:
¾ Ldifde -f c:\ldifde.txt -t 3268 -d DC=xxxx,DC=COM –r "(serviceprincipalname=MSOMHSvc/*)" -l serviceprincipalname -p subtree
¾ Ldifde -f c:\ldifde.txt -t 3268 -d DC=xxxx,DC=COM –r "(serviceprincipalname=MSOMSdkSvc/*)" -l serviceprincipalname -p subtree
Espero que ajude quem precisar !!!
Abraço !
