S2D Cluster Error 1207 - Access is Denied

[Warwick_Tech]

Hi All,

 

Bit of an odd one, which I'm scratching my head over;

 

Our S2D cluster is complaining about password changes with error 1207

https://kb.eventtracker.com/evtpass/evtPages/EventId_1207_Microsoft-Windows-FailoverClustering_64599.asp

 

This happens every hour on the dot;

 

The computer object associated with the cluster network name resource 'xx' could not be updated in domain 'xx' during the

Password change operation.

 

The text for the associated error code is: Access is denied.

 

 

The cluster identity 'xx' may lack permissions required to update the object. Please work with your domain administrator to ensure that the cluster identity can update computer objects in the domain.

 

now I remember ages ago because of a pingcastle thread I disabled the ability for users to add computers to the domain

 

Start – Administrative Tools – ADSI Edit

Right click Domain Name – Properties

Attribute Editor Tab – ms-DS-MachineAccountQuota – Click Edit – set to 0 –press ok

 

That users in the Administrators or Domain Administrators groups, and those users who have delegated permissions on containers in Active Directory to create and delete computer accounts, are not restricted by this limitation.

 

And I changed the default domain policy to only include 1 user who could add machines to the domain, and the 3 cluster computers (gensvc was already in there I think)

 

 

Anyone have any ideas? I might change the ADSI back to '10' and see if that works (?)

[Steve21]

That’s not about adding computers

 

That’s the cluster computer account/service that needs access on the CNO and hosts computer accounts to modify their properties etc

 

Should normally have full control on them as part of the wizard when it sets up

 

Have you moved the hosts or restricted what the cluster account can do?

 

Steve

Edited July 13, 2023 by Steve21

[Warwick_Tech]

That’s not about adding computers

 

That’s the cluster computer account/service that needs access on the CNO and hosts computer accounts to modify their properties etc

 

Should normally have full control on them as part of the wizard when it sets up

 

Have you moved the hosts or restricted what the cluster account can do?

 

Steve

 

No, they all live in the same place in AD -

It keeps adding them all to 'Account Operators' but each time I remove them or change permissions it puts them back again.

[Warwick_Tech]

Ok, so maybe some progress?

 

I've found this error can also be caused by port 464 being closed - But I can access the DC from the Cluster;

 

But not from the DC to the Cluster;

 

Could someone else with a Cluster check if this is expected behaviour?

Test-NetConnection -ComputerName -Port 464

[SparkySX]

Ok, so maybe some progress?

 

I've found this error can also be caused by port 464 being closed - But I can access the DC from the Cluster;

[ATTACH=CONFIG]69511[/ATTACH]

 

But not from the DC to the Cluster;

[ATTACH=CONFIG]69512[/ATTACH]

 

Could someone else with a Cluster check if this is expected behaviour?

 

I'm getting the same results as you but no 1207 errors

 

Have you checked the permissions against this KB:

Prestage cluster computer objects in Active Directory Domain Services | Microsoft Learn

[Warwick_Tech]

I'm getting the same results as you but no 1207 errors

 

Have you checked the permissions against this KB:

Prestage cluster computer objects in Active Directory Domain Services | Microsoft Learn

 

Ah - Now another interesting development, when I add 'Account Operators' to the Cluster Computer Account, it removes it after a few hours...

 

...I found this with any other permissions I added, if I have a user/computer who is a member of 'Account Operators' then any custom settings I apply are 'reset' in a few hours...