Same here. Switching from 5500 WLC controller 1 (7.0.235.0) to controller 2 (7.0.240.0), a handful of APs will have none of it, they're happy to sit on controller 1 but it's as though controller 2 hasn't been told about them before so won't let them in.
We've had the same issue when both controllers were on 7.0.230.0, also with both on 7.0.235.0.
The system works but it means that if controller 1 fails controller 2 will take on most of the APs, but not all.
Both controllers have enough licences to cope with all of our APs (200 controller 1, 175 controller 2, 200 WCS, we have 171 APs).
UPDATE
Whilst comparing configurations, screen by screen, between our two main controllers (only one of which will talk to the anchor right now, hence the compare job) I came across the following page:-
In the WLC GUI: SECURITY -> AAA -> AP Policies
In the WCS GUI: Configure -> Controllers -> {controller IP address} -> Security -> AAA -> AP / MSE Authorization
This contains a list of all the self-signed APs allowed to connect. In our case there were 31 on the first controller but only 12 on the second. I've now copied all of the missing ones from the first controller to the second. One of the APs that previously wouldn't run on controller 2 is now happy to run there. All were Aironet 1100 and 1230 series which had been converted from autonomous to lightweight.
Hope this helps someone.
