Learn how to a build a cloud-first strategyRegister Now


2003 Cluster fails after 4 successful days running under a new Cluster Service account

Posted on 2007-10-18
Medium Priority
Last Modified: 2010-04-20
OurCorporate policy is to change 'system' passwords when someone leaves. I was asked to modify the Domain Administrator account for my 2003 domain which was also being used as the Cluster Service account for my two Windows 2003 cluster nodes. I decided to create a different account clusadmin to sue for the Cluster, and gave it the correct rights as per the MS Knowlegebase article 269229.
I stopped the Cluster Service on both nodes, changed the service account and brought up the cluster without issue. Later, I then changed the domain administrator password. Everything went well for four days (about 100 hours) and then all the cluster resources started failing.
The error for each clustered resource was '9016 DNS signature failed to verify.'
The only way I managed to get round the problem was to change the Cluster Service account back to the domain administrator account (using the new password), restart the first node, and all came up fine. The second node was then brought up successfully.
 What could cause this behaviour, after 4 successful days? I gave the clusadmin account all the rights I believe it should have had. Does some backend process run after 100 hours or something that could cause this? Thanks.
Question by:hqpsystems
LVL 22

Accepted Solution

65td earned 1500 total points
ID: 20102565
Possibly DNS, replace cluster service with new the cluster service account.
Go to DNS delete the administrative cluster server DNS entry, actually delete all cluster virtual names (not node names), fail the groups over.  Cluster service account should be able to create and change DNS entry.

In DNS review the TTL (Time To Live) data on the entry

Author Comment

ID: 20108368
I am currently reluctant to try the new cluster account again, especially as we are a 24 hour site and getting any downtime (intended downtime, that is!) is very tricky and political. In DNS, enabled the Advanced View so I could view the TTL for the Cluster and its resources, they are all set to 20 minutes. Is this the default, and should it be changed? Doesn't seem to explain why the resources stayed up on the new account for around 100 hours.

Expert Comment

ID: 20111873
The c:\windows\cluster\cluster.log file will probably say what went wrong when the cluster failed, if the "network name" resources are what failed, unchecking "require dns registration to succeed" will fix that temporarily, but will need to fix the problem eventually.

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
High user turnover can cause old/redundant user data to consume valuable space. UserResourceCleanup was developed to address this by automatically deleting user folders when the user account is deleted.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question