AD Permission Issue Preventing SQL Server FCI from Failing Over

Question

Hi,

We are currently experiencing an issue with the Windows Failover Cluster hosting the SQL Server Failover Cluster Instance (FCI). The cluster is unable to bring the SQL Server role online or perform failover/failback between the cluster nodes due to Active Directory and DNS permission-related errors.

Issue Summary

• SQL Server FCI Network Name: name
• Impact:
  • SQL Server services cannot be brought online through the cluster.
    • Failover and failback operations between cluster nodes are failing.
      • The SQL FCI virtual network name cannot be authenticated or registered in DNS.

Observed Errors

1. DNS Registration Failure

• Cluster network name resource failed registration of one or more associated DNS name(s) because access to update the secure DNS Zone was denied.
  • Cluster Network Name: SQL Network Name (name)
  • DNS Zone: domainname.com

1. Active Directory Computer Object Missing

• Cluster network name resource failed to find the associated computer object in Active Directory.
  • Network Name: SQL Network Name (name)
  • Guidance from the event log indicates that the associated Virtual Computer Object (VCO) should be restored from the Active Directory Recycle Bin or recreated using the Cluster Network Name resource repair action.

1. Authentication Failure
   • Cluster network name resource 'SQL Network Name ()' encountered an error enabling the network name on this node.
   • Reason: Unable to obtain a logon token
   • Error Code: 1326 (Logon failure: unknown user name or bad password)

Assistance Required

Could you please verify the following:

1. Confirm that the Virtual Computer Object (VCO) xxxxxxx$ exists in Active Directory and is enabled.
2. If the VCO was deleted, restore it from the Active Directory Recycle Bin or advise on recreating it.
3. Verify that the Cluster Name Object (CNO) has the required permissions to:

• Create and manage computer objects in the appropriate OU.
  • Update secure DNS records in the domainname.com DNS zone.

1. Verify that the DNS record for dnsname exists, is healthy, and is owned by the correct security principal.
2. Confirm there are no Active Directory replication or DNS permission issues affecting the cluster resources.

Once the Active Directory and DNS permissions have been corrected, we will bring the cluster resources online and validate SQL Server failover/failback functionality.

This issue is currently preventing the SQL Server Failover Cluster Instance from operating normally, so your assistance at the earliest opportunity would be appreciated.

Thank you.

Answer 1

Welcome to Microsoft Q&A!

Thank you for providing the detailed error information.

The reported events indicate an Active Directory and secure DNS registration issue affecting the SQL Server FCI Virtual Computer Object (VCO). If the cluster cannot locate, authenticate, or update the VCO, the SQL Network Name resource cannot come online, which prevents the SQL Server role from starting or failing over. This is consistent with Event IDs 1207/1219 and error 1326.

Please ask the AD/DNS administrator to verify the following:

1. VCO status

• Confirm that the VCO xxxxxxx$ exists in Active Directory and is enabled.
• If it was deleted, restore it from the AD Recycle Bin or recreate/prestage it.
• After correcting permissions, use the cluster Network Name resource’s Repair action if password synchronization is required.

2. CNO permissions

• Confirm that the Cluster Name Object (CNO) exists and is enabled.
• Ensure that the CNO has Create Computer objects and Read all properties permissions in the OU containing the cluster computer objects.
• If the VCO is prestaged, grant the CNO the required permissions on that VCO.

3. Secure DNS permissions

• Verify that the CNO/VCO can create and update records in the secure domainname.com DNS zone.
• Check whether the existing DNS record for dnsname is stale or owned by an incorrect security principal. Insufficient secure DNS permissions can be the cause of Network Name resources failing to come online.

4. Domain controller and replication health

• Confirm that every cluster node can locate a writable domain controller and resolve the domain correctly.
• Check AD replication and DNS health for outdated or inconsistent object information.

After correcting the AD object and DNS permissions, bring the SQL Network Name resource online and test failover and failback.

If the issue continues, collect the cluster logs from all nodes: Get-ClusterLog -UseLocalTime -Destination C:\ClusterLogs

Also review the FailoverClustering, DNS Server, and Directory Services event logs.

Most likely cause: The SQL FCI VCO is missing, disabled, or inaccessible, or the CNO lacks permission to manage the VCO and securely update its DNS record.

For additional information, please visit:

Prestage cluster computer objects in Active Directory Domain Services | Microsoft Learn

Windows Server 2019 cluster role doesn't come online after you rebuild the cluster - Windows Server | Microsoft Learn

If the answer is helpful, please click Accept Answer.

Thank you for using Microsoft Q&A.