Jetty server not listening on 443 for Satellite Authentication on Windows (TID 7008087)

I have the following situation:

I had a Working satellite server with all satellite roles. We patched our primary server and this satellite server to 11.2.1 Monthly update 1 (from v11 no patches).
We had not yet patched the clients but had no issues.

A week after the update, we patched a single client to 11.2.1 Monthly update 1 (Client was using the satellite server for authentication)
This client had authenication issues (other clients were fine) and during our trouble shooting we removed and re-added the Authentication role on the satellite server.

This was a mistake as this broke authentication for all clients using this satellite server and we have been forced to point clients to the primary server for authentication.

After looking at TID 7008087 and experimenting I have discovered that the authentication role is not listening on port 443

if I experiment by:

Remove Authentication role from satellite server and Re-add Authentication role.

https://server/CasaAuthTokenSvc/tmp has file not found error
http://server/zenworks-ping has an error serving request
Jetty server is not listening on port 443 as it didn't start properly
There is a log file in ZENWorks\java\lib\core\configuration which indicates org.eclipse.osgi application error

the following files and directorys are missing (there may be others):

[InstallPath]\ZENWorks\webserver\webapps\zenworks-ping\ (no directory)
[InstallPath]\ZENWorks\webserver\webapps\CasaAuthTokenSvc\ (no directory)
[InstallPath]\ZENWorks\java\lib\core\configuration\org.eclipse. core.runtime\ (no directory)

If I copy config.ini back from a working server and restart Authentication service

The following 2 directories are re-created (including sub files)
ZENWorks\java\lib\core\configuration\org.eclipse.c ore.runtime\

https://server/CasaAuthTokenSvc/tmp now returns a string (it is different to what the primary server returns)
Jetty server is now listening on port 443
http://server/zenworks-ping still has an error serving request

lastly if I copy these files/directories back as they are still missing:

http://server/zenworks-ping still has an error

If I remove the authentication Role and re-add it again, the same thing happens with files missing and the service not listening

Both the satellite and primary server are Windows 2008 R2 SP1 (one of each)
The database is on SQL 2008 R2 SP1

I have just opened a SR