Exchange 2010 SP1 upgrade to SP2 failed with AD connection error

Our current Exchange Organization consist of 2 child domain us.contoso.intra and cn.contoso.intra and a parent domain contoso.intra, with Exchange 2010 server and Exchange 2003 servers coexist across the global. All Exchange 2010 is on SP1 only.

Last night I tried to upgrade our CAS and HUB Exchange 2010 server to SP2. After I prepare the schema and AD successfully, I start the upgrade Wizard. It passed all readiness check and I went on with the upgrade, everything was ok unitl it reaches Transport Role, it gives me following errors:

Summary: 13 item(s). 9 succeeded, 1 failed.
Elapsed time: 00:22:49
Preparing Setup
Completed
Elapsed Time: 00:00:03
Stopping Services
Completed
Elapsed Time: 00:02:27
Languages
Completed
Elapsed Time: 00:00:00
Remove Exchange Files
Completed
Elapsed Time: 00:01:55
Preparing Files
Completed
Elapsed Time: 00:00:00
Copy Exchange Files
Completed
Elapsed Time: 00:01:23
Language Files
Completed
Elapsed Time: 00:11:15
Restoring services
Completed
Elapsed Time: 00:00:04
Languages
Completed
Elapsed Time: 00:02:33
Hub Transport Role
Failed
Error:
The following error was generated when "$error.Clear(); 
          Set-WERRegistryMarkers;" was run: "Provisioning layer initialization failed: 'Failed to reconnect to Active Directory server DC01.contoso.intra. Make sure the server is available, and that you have used the correct credentials.'".
Provisioning layer initialization failed: 'Failed to reconnect to Active Directory server DC01.contoso.intra. Make sure the server is available, and that you have used the correct credentials.'
Failed to reconnect to Active Directory server DC01.contoso.intra. Make sure the server is available, and that you have used the correct credentials.
Active Directory server DC01.contoso.intra is not available. Please retry at a later time.
Click here for help... http://technet.microsoft.com/en-US/library/ms.exch.err.default(EXCHG.141).aspx?v=14.2.247.1&e=ms.exch.err.Ex88D115&l=0&cl=cp
Elapsed Time: 00:03:06
Client Access Role
Cancelled
Management Tools
Cancelled
Finalizing Setup
Cancelled

I google the error and discover it is a known issue if you have SCOM 2007 agent installedhttp://support.microsoft.com/kb/2713696

We do not have SCOM 2007, but the server does have SCCM 2007 on it. Not sure if this will be a cause?

The account I am using for upgrade is an enterprise admin which I used to install Exchange 2010 back to the days. So I believe the permission should not be a cause here.

I can confirm the Exchange CAS/hub box has access to DC01, it can ping, can lookup DNS normally.

After the failure the server is screwed. OWA no longer works. Fortunately it is a VM and I took a snapshot before the upgrade, so after roll back to the snapshot, all things back to normal.

Anyone experience the same error? Could AV client be a factor here? We use Symantec Endpoint with only AV component, no network protection etc... Not sure what cause the error, any suggestions?