I spent a while searching around for this gem. Basically the domain controllers don’t trust the local system account so you have to run the HSLockdown.exe tool. I found this blog article that explains:
http://scug.be/blogs/scom/archive/2008/08/18/opsmgr-agent-greyed-out-on-domain-controller.aspx