robyholmes Posted June 21, 2022 Posted June 21, 2022 I'm trying to get Cluster Aware Updating to work on my two node cluster but I can't seem to get the 'Windows PowerShell remote should be enabled on each failover cluster node' to pass the check. Running the Test-CauSetup command in PowerShell shows me two error messages as follows: WARNING: Connecting to remote server SRV-HOST-B failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. WARNING: Connecting to remote server SRV-HOST-B failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. What I find really odd, is SRV-HOST-B is the name of the server I'm running the test on. So it's failing to connect back to itself from what I can see. Running it on the other cluster node results in the same issue, failed to connect to itself. All I can find online is making sure the firewall rule for 'Remote Shutdown Group' which is 'Inbound Rule for Remote Shutdown' looks to be correct and surely it shouldn't impact a loopback to itself? Any more ideas, I've tried quite a few already and it's the same error each time, so I don't seem to be affecting it in anyway. Thanks, Rob
Oaktech Posted June 21, 2022 Posted June 21, 2022 Windows Remote Management service enabled? Run: Enable-PSRemoting Domain admin account definitely part of local admins group?
robyholmes Posted June 21, 2022 Author Posted June 21, 2022 Windows Remote Management service enabled? Run: Enable-PSRemoting Domain admin account definitely part of local admins group? Yes run this and no error is shown so I'm assuming it's running. The CAU Computer account and administrator account we use (We don't use the default one) are in local admins. What I don't get is why is it not failing to connect to the other node? Why only itself? Does it not check the other one or is that working? Odd.
robyholmes Posted June 21, 2022 Author Posted June 21, 2022 Just to add, I've put this in the 2019 forum section but I must have been asleep this morning as the host servers are running Server 2022. Just in case that matters.
chaplic Posted June 21, 2022 Posted June 21, 2022 Yes run this and no error is shown so I'm assuming it's running. The CAU Computer account and administrator account we use (We don't use the default one) are in local admins. What I don't get is why is it not failing to connect to the other node? Why only itself? Does it not check the other one or is that working? Odd. Is it failing connecting back to itself because of UAC? Is your powershell prompt elevated?
robyholmes Posted June 21, 2022 Author Posted June 21, 2022 Is it failing connecting back to itself because of UAC? Is your powershell prompt elevated? No, same when running elevated.
CrootUK Posted June 21, 2022 Posted June 21, 2022 I have noticed CAU acts very strangely when user running it is part of the “Protected Users” group, if you are a part of it try dropping out when running CAU. 2
robyholmes Posted June 22, 2022 Author Posted June 22, 2022 I have noticed CAU acts very strangely when user running it is part of the “Protected Users” group, if you are a part of it try dropping out when running CAU. That's the one! Removed the user I was testing with from Protected Users and we're away! The only issue now is PingCastle won't be happy with me again ha. Any idea how I could keep it in Protected Users but authorise CAU to run? That would be the perfect solution.
free780 Posted June 22, 2022 Posted June 22, 2022 That's the one! Removed the user I was testing with from Protected Users and we're away! The only issue now is PingCastle won't be happy with me again ha. Any idea how I could keep it in Protected Users but authorise CAU to run? That would be the perfect solution. It's to do with SPNs and Kerberos authentication. Users in Protected Users cannot use NTLM. 1
robyholmes Posted June 22, 2022 Author Posted June 22, 2022 It's to do with SPNs and Kerberos authentication. Users in Protected Users cannot use NTLM. What I can't find is what account it's running as when scheduled to run. Task Scheduler has a folder for it but no tasks in it, even though it's schedule to run itself. Hmmm
jthompson Posted June 22, 2022 Posted June 22, 2022 (edited) Do your firewall rules relating to remote shutdown make allowance for the remote shutdown command coming from the local server? FWIW, I generally run CAU from a server that isn't one of the cluster nodes. The user account I use is in Protected Users. Edited June 22, 2022 by jthompson
jthompson Posted June 22, 2022 Posted June 22, 2022 I can't remember if adding suitable permissions to the cluster computer object in AD helps with getting CAU working or not. Might be worth Googling.
robyholmes Posted June 22, 2022 Author Posted June 22, 2022 I can't remember if adding suitable permissions to the cluster computer object in AD helps with getting CAU working or not. Might be worth Googling. Yes I've not limited it to users or groups, just the incoming IP address.
JoeDunc Posted January 12 Posted January 12 This solved my problem. I was using my usual Remote Desktop account, but I had to login with a local administrator account. I still have other errors, but I'm not having the same issue stating PowerShell . Working on correcting the other errors and going through the wizard to enable cluster enabled updating.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now