Cluster Aware Updating - Remote Powershell - Failed to connect

[robyholmes]

I'm trying to get Cluster Aware Updating to work on my two node cluster but I can't seem to get the 'Windows PowerShell remote should be enabled on each failover cluster node' to pass the check. Running the Test-CauSetup command in PowerShell shows me two error messages as follows:

 

WARNING: Connecting to remote server SRV-HOST-B failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.
WARNING: Connecting to remote server SRV-HOST-B failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.

 

What I find really odd, is SRV-HOST-B is the name of the server I'm running the test on. So it's failing to connect back to itself from what I can see. Running it on the other cluster node results in the same issue, failed to connect to itself.

 

All I can find online is making sure the firewall rule for 'Remote Shutdown Group' which is 'Inbound Rule for Remote Shutdown' looks to be correct and surely it shouldn't impact a loopback to itself?

 

Any more ideas, I've tried quite a few already and it's the same error each time, so I don't seem to be affecting it in anyway.

 

Thanks, Rob

[Oaktech]

Windows Remote Management service enabled?

 

Run: Enable-PSRemoting

 

Domain admin account definitely part of local admins group?

[robyholmes]

Windows Remote Management service enabled?

 

Run: Enable-PSRemoting

 

Domain admin account definitely part of local admins group?

 

Yes run this and no error is shown so I'm assuming it's running.

 

The CAU Computer account and administrator account we use (We don't use the default one) are in local admins.

 

What I don't get is why is it not failing to connect to the other node? Why only itself? Does it not check the other one or is that working? Odd.

[robyholmes]

Just to add, I've put this in the 2019 forum section but I must have been asleep this morning as the host servers are running Server 2022. Just in case that matters.

[chaplic]

Yes run this and no error is shown so I'm assuming it's running.

 

The CAU Computer account and administrator account we use (We don't use the default one) are in local admins.

 

What I don't get is why is it not failing to connect to the other node? Why only itself? Does it not check the other one or is that working? Odd.

 

Is it failing connecting back to itself because of UAC? Is your powershell prompt elevated?

[robyholmes]

Is it failing connecting back to itself because of UAC? Is your powershell prompt elevated?

 

No, same when running elevated.

[CrootUK]

I have noticed CAU acts very strangely when user running it is part of the “Protected Users” group, if you are a part of it try dropping out when running CAU.

[robyholmes]

I have noticed CAU acts very strangely when user running it is part of the “Protected Users” group, if you are a part of it try dropping out when running CAU.

 

That's the one! Removed the user I was testing with from Protected Users and we're away! The only issue now is PingCastle won't be happy with me again ha. Any idea how I could keep it in Protected Users but authorise CAU to run? That would be the perfect solution.

[free780]

That's the one! Removed the user I was testing with from Protected Users and we're away! The only issue now is PingCastle won't be happy with me again ha. Any idea how I could keep it in Protected Users but authorise CAU to run? That would be the perfect solution.

 

It's to do with SPNs and Kerberos authentication.

 

Users in Protected Users cannot use NTLM.

[robyholmes]

It's to do with SPNs and Kerberos authentication.

 

Users in Protected Users cannot use NTLM.

 

What I can't find is what account it's running as when scheduled to run. Task Scheduler has a folder for it but no tasks in it, even though it's schedule to run itself. Hmmm

[jthompson]

Do your firewall rules relating to remote shutdown make allowance for the remote shutdown command coming from the local server?

 

FWIW, I generally run CAU from a server that isn't one of the cluster nodes. The user account I use is in Protected Users.

Edited June 22, 2022 by jthompson

[jthompson]

I can't remember if adding suitable permissions to the cluster computer object in AD helps with getting CAU working or not. Might be worth Googling.

[robyholmes]

I can't remember if adding suitable permissions to the cluster computer object in AD helps with getting CAU working or not. Might be worth Googling.

 

Yes I've not limited it to users or groups, just the incoming IP address.

[JoeDunc]

This solved my problem. I was using my usual Remote Desktop account, but I had to login with a local administrator account. I still have other errors, but I'm not having the same issue stating PowerShell . Working on correcting the other errors and going through the wizard to enable cluster enabled updating.