Cross-forest deployment problems

The Sophos KB has a PureMessage article that mentions a similar error and advises the use of Setspn

http://www.sophos.com/en-us/support/knowledgebase/113609.aspx

I don’’’’t think this is a problem caused by Sophos though, but rather the result of the network/environment.

Googling the error (A security package specific error occurred.) there are plenty of blog articles mentioning things like stale computer accounts and Kerberos authentication failures, as well as problems with domain controllers, etc.  Example:

http://blogs.technet.com/b/brad_rutkowski/archive/2011/03/08/solution-for-a-security-package-specific-error-occurred.aspx

http://www.rubertus.net/Blog/tabid/85/EntryId/21/Kerberos-Event-ID-1825-A-security-package-specific-error-occurred.aspx

You may have to read around the articles and see what applies best to your environment.  Post back what you find out.

As for I can [...] when I use the test system's IP I think the explanation is somewhat hidden in Microsoft Negotiate: Currently, the Negotiate security package selects between Kerberos and NTLM. Negotiate selects Kerberos unless it cannot be used by one of the systems involved in the authentication or the calling application did not provide sufficient information to use Kerberos. Guess the latter is the case if you specify an IP.

Christian

Thanks guys, these were helpful suggestions. After adding the other forest's domains and subdomains to the DNS settings of the Sophos Endpoint Server, I was able to deploy the client to systems in that domain.