2003 Cluster fails after 4 successful days running under a new Cluster Service account

Posted on 2007-10-18
Last Modified: 2010-04-20
OurCorporate policy is to change 'system' passwords when someone leaves. I was asked to modify the Domain Administrator account for my 2003 domain which was also being used as the Cluster Service account for my two Windows 2003 cluster nodes. I decided to create a different account clusadmin to sue for the Cluster, and gave it the correct rights as per the MS Knowlegebase article 269229.
I stopped the Cluster Service on both nodes, changed the service account and brought up the cluster without issue. Later, I then changed the domain administrator password. Everything went well for four days (about 100 hours) and then all the cluster resources started failing.
The error for each clustered resource was '9016 DNS signature failed to verify.'
The only way I managed to get round the problem was to change the Cluster Service account back to the domain administrator account (using the new password), restart the first node, and all came up fine. The second node was then brought up successfully.
 What could cause this behaviour, after 4 successful days? I gave the clusadmin account all the rights I believe it should have had. Does some backend process run after 100 hours or something that could cause this? Thanks.
Question by:hqpsystems
    LVL 22

    Accepted Solution

    Possibly DNS, replace cluster service with new the cluster service account.
    Go to DNS delete the administrative cluster server DNS entry, actually delete all cluster virtual names (not node names), fail the groups over.  Cluster service account should be able to create and change DNS entry.

    In DNS review the TTL (Time To Live) data on the entry

    Author Comment

    I am currently reluctant to try the new cluster account again, especially as we are a 24 hour site and getting any downtime (intended downtime, that is!) is very tricky and political. In DNS, enabled the Advanced View so I could view the TTL for the Cluster and its resources, they are all set to 20 minutes. Is this the default, and should it be changed? Doesn't seem to explain why the resources stayed up on the new account for around 100 hours.
    LVL 1

    Expert Comment

    The c:\windows\cluster\cluster.log file will probably say what went wrong when the cluster failed, if the "network name" resources are what failed, unchecking "require dns registration to succeed" will fix that temporarily, but will need to fix the problem eventually.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Free Trending Threat Insights Every Day

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Some time ago I faced the need to use a uniform folder structure that spanned across numerous sites of an enterprise to be used as a common repository for the Software packages of the Configuration Manager 2007 infrastructure. Because the procedu…
    Know what services you can and cannot, should and should not combine on your server.
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now