So you are saying that the OCS Server is running on a Domain Controller?
That is NOT Supported
So probably your Front-End service wants to startup before AD does and cannot authenticate because of that.
If you start it manually later it starts fine?
Try to add dependencies on the service.
But again OCS is not supported on DCs