Today I came across an issue with updates which were unable to download from an SCCM Distribution Point. Further investigation pointed to the fact that the Content Transfer Manager log located under C:\Windows\CCM\Logs\ contained error code 0x80070005 relating to ACCESS DENIED.
Pasting one of the URL’s of an update from the Content Transfer Manager Log into the browser confirmed that indeed access was denied to that content.
Opening IIS on the SCCM Distribution Point it was noted that no authentication was specified on the sub-sites as below. On this particular instance Windows Authentication was missing and the only options were Anonymous Authentication or ASP.NET Impersonation.
We could enable Anonymous Authentication to resolve this issue but in terms of security that would not be best practice. If like this instance Windows Authentication is missing (it appears as though the SCCM installation of a DP will continue if Windows Authentication is missing) you will need to enable this in Server Manager under the feature Web Server/Security as below.
Restart IIS and enable Windows Authentication on both the SMS_DP_SMSPKG$ and SMS_DP_SMSSIG$ sub-sites of the Default Web Site.
Updates downloading and installing successfully!