Network Name fails to come online

the computer account cluster resource 'labfp1' in domain lab.com not created following reason: unable create computer account.
 
the text associated error code is: access denied.

 
the cluster identity 'labcl1$' may lack ability create computer objects in default computers container or @ quota of computer objects can own. if there existing computer object, verify cluster identity 'labcl1$' has 'full control' access computer object using active directory users , computers tool. default computer objects created in 'computers' container; consult domain administrator if location has been changed. domain administrator should contacted assist resolving issue.

 

i have logged in domain admin , run wizard configure service. why use machine account context rather user context?

 

i missing obvious?

 

running longhorn beta 3, x64

 

regards

 

steve

hi steve,

 

in longhorn network names must have associated computer object created it, setting of requirekerberos on (and can't disabled).

 

when first create cluster cluster name has computer object created it, called cluster name object (cno).  cno created security context of user logged on when creating cluster.  once you've got cluster , running, service self managing.  when run high availability role wizard create groups , resources, network name resources have computer objects associated them.  network name resources have associated virtual computer object (vco).  vco's created using security context of cno.  instead of needing grant user ability create child objects of cluster, granting them cluster computer object.

 

so correct issue in locked down domain either can grant cno permission create computer objects in default container, or can manually pre-create computer object , grant cno full control permission vco object.  note:  when doing vco needs in disabled state can hijacked.

 

it's little confusing @ first , know different in granting permission computer objects instead of users, in end enables cluster self managing.

 

thanks!!

elden christensen

program manager

windows failover cluster group

microsoft enterprise server products

 

of course, posting wouldn’t complete without nice, juicy disclaimer our lawyers: posting provided "as is" no warranties, , confers no rights. assume risk use. © 2007 microsoft corporation. rights reserved.
http://www.microsoft.com/info/cpyright.htm

Windows Server  >  High Availability (Clustering)