Failover Clustering system log events

This article lists the Failover Clustering events from the Windows Server System log (viewable in Event Viewer). These events all share the event source of FailoverClustering and can be helpful when troubleshooting a cluster.

Applies to:   Windows Server 2022, Windows Server 2019, Windows Server 2016, Azure Stack HCI, versions 21H2 and 20H2

Critical events

Event 1000: UNEXPECTED_FATAL_ERROR

Cluster service suffered an unexpected fatal error at line %1 of source module
%2. The error code was %3.

Event 1001: ASSERTION_FAILURE

Cluster service failed a validity check on line %1 of source module %2. '%3'

Event 1006: NM_EVENT_MEMBERSHIP_HALT

Cluster service was halted due to incomplete connectivity with other cluster
nodes.

Event 1057: DM_DATABASE_CORRUPT_OR_MISSING

The cluster database could not be loaded. The file may be missing or corrupt.
Automatic repair might be attempted.

Event 1070: NM_EVENT_BEGIN_JOIN_FAILED

The node failed to join failover cluster '%1' due to error code '%2'.

Event 1073: CS_EVENT_INCONSISTENCY_HALT

The Cluster service was halted to prevent an inconsistency within the failover
cluster. The error code was '%1'.

Event 1080: CS_DISKWRITE_FAILURE

The Cluster service failed to update the cluster database (error code '%1').
Possible causes are insufficient disk space or file system corruption.

Event 1090: CS_EVENT_REG_OPERATION_FAILED

The Cluster service cannot be started. An attempt to read configuration data
from the Windows registry failed with error '%1'. Please use the Failover
Cluster Management snap-in to ensure that this machine is a member of a cluster.
If you intend to add this machine to an existing cluster use the Add Node
Wizard. Alternatively, if this machine has been configured as a member of a
cluster, it will be necessary to restore the missing configuration data that is
necessary for the Cluster Service to identify that it is a member of a cluster.
Perform a System State Restore of this machine in order to restore the
configuration data.

Event 1092: NM_EVENT_MM_FORM_FAILED

Failed to form cluster '%1' with error code '%2'. Failover cluster will not be
available.

Event 1093: NM_EVENT_NODE_NOT_MEMBER

The Cluster service cannot identify node '%1' as a member of failover cluster
'%2'. If the computer name for this node was recently changed, consider
reverting to the previous name. Alternatively, add the node to the failover
cluster and if necessary, reinstall clustered applications.

Event 1105: CS_EVENT_RPC_INIT_FAILED

The Cluster service failed to start because it was unable to register
interface(s) with the RPC service. The error code was '%1'.

Event 1135: EVENT_NODE_DOWN

Cluster node '%1' was removed from the active failover cluster membership. The
Cluster service on this node may have stopped. This could also be due to the
node having lost communication with other active nodes in the failover cluster.
Run the Validate a Configuration wizard to check your network configuration. If
the condition persists, check for hardware or software errors related to the
network adapters on this node. Also check for failures in any other network
components to which the node is connected such as hubs, switches, or bridges.

Event 1146: RCM_EVENT_RESMON_DIED

The cluster Resource Hosting Subsystem (RHS) process was terminated and will be
restarted. This is typically associated with cluster health detection and
recovery of a resource. Refer to the System event log to determine which
resource and resource DLL is causing the issue.

Event 1177: MM_EVENT_ARBITRATION_FAILED

The Cluster service is shutting down because quorum was lost. This could be due
to the loss of network connectivity between some or all nodes in the cluster, or
a failover of the witness disk.

Run the Validate a Configuration wizard to check your network configuration. If
the condition persists, check for hardware or software errors related to the
network adapter. Also check for failures in any other network components to
which the node is connected such as hubs, switches, or bridges.

Event 1181: NETRES_RESOURCE_START_ERROR

Cluster resource '%1' cannot be brought online because the associated service
failed to start. The service return code is '%2'. Please check for additional
events associated with the service and ensure the service starts correctly.

Event 1247: CLUSTER_EVENT_INVALID_SERVICE_SID_TYPE

The Security Identifier (SID) type for the cluster service is configured as '%1'
but the expected SID type is 'Unrestricted'. The cluster service is
automatically modifying its SID type configuration with the Service Control
Manager (SCM) and will restart in order for this change to take effect.

Event 1248: CLUSTER_EVENT_SERVICE_SID_MISSING

The Security Identifier (SID) '%1' associated with the cluster service is not
present in the process token. The cluster service will automatically correct
this problem and restart.

Event 1282: SM_EVENT_HANDSHAKE_TIMEOUT

Security Handshake between local and remote endpoints '%2' did not complete in
'%1' seconds, node terminating the connection

Event 1542: SERVICE_PRERESTORE_FAILED

The restore request for the cluster configuration data has failed. This restore
failed during the 'pre-restore' stage usually indicating that some nodes
comprising the cluster are not currently operational. Ensure that the cluster
service is running successfully on all nodes comprising this cluster.

Event 1543: SERVICE_POSTRESTORE_FAILED

The restore operation of the cluster configuration data has failed. This restore
failed during the 'post-restore' stage usually indicating that some nodes
comprising the cluster are not currently operational. It is recommended that you
replace the current cluster configuration data file (ClusDB) with '%1'.

Event 1546: SERVICE_FORM_VERSION_INCOMPATIBLE

Node '%1' failed to form a failover cluster. This was due to one or more nodes
executing incompatible versions of the cluster service software. If node '%1' or
a different node in the cluster has been recently upgraded, please re-verify
that all nodes are executing compatible versions of the cluster service
software.

Event 1547: SERVICE_CONNECT_VERSION_INCOMPATIBLE

Node '%1' attempted to join a failover cluster but failed due to incompatibility
between versions of the cluster service software. If node '%1' or a different
node in the cluster has been recently upgraded, please verify that the changed
cluster deployment with different versions of the cluster service software is
supported.

Event 1553: SERVICE_NO_NETWORK_CONNECTIVITY

This cluster node has no network connectivity. It cannot participate in the
cluster until connectivity is restored. Run the Validate a Configuration wizard
to check your network configuration. If the condition persists, check for
hardware or software errors related to the network adapter. Also check for
failures in any other network components to which the node is connected such as
hubs, switches, or bridges.

Event 1554: SERVICE_NETWORK_CONNECTIVITY_LOST

This cluster node has lost all network connectivity. It cannot participate in the cluster until connectivity is restored. The cluster service on this node
will be terminated.

Event 1556: SERVICE_UNHANDLED_EXCEPTION_IN_WORKER_THREAD

The cluster service encountered an unexpected problem and will be shut down. The error code was '%2'.

Event 1561: SERVICE_NONSTORAGE_WITNESS_BETTER_TAG

Cluster service failed to start because this node detected that it does not have
the latest copy of cluster configuration data. Changes to the cluster occurred
while this node was not in membership and as a result was not able to receive
configuration data updates.

Guidance

Attempt to start the cluster service on all nodes in the cluster so that nodes with the latest copy of the cluster configuration data can first form the cluster. This node will then be able join the cluster and will automatically obtain the updated cluster configuration data. If there are no nodes available with the latest copy of the cluster configuration data, run the Start-ClusterNode -FQ Windows PowerShell cmdlet. Using the ForceQuorum (FQ) parameter will start the cluster service and mark this node's copy of the cluster configuration data to be authoritative. Forcing quorum on a node with an outdated copy of the cluster database may result in cluster configuration changes that occurred while the node was not participating in the cluster to be lost.

Event 1564: RES_FSW_ARBITRATEFAILURE

File share witness resource '%1' failed to arbitrate for the file share '%2'.
Please ensure that file share '%2' exists and is accessible by the cluster.

Event 1570: SERVICE_CONNECT_AUTHENTICATION_FAILURE

Node '%1' failed to establish a communication session while joining the cluster.
This was due to an authentication failure. Please verify that the nodes are
running compatible versions of the cluster service software.

Event 1571: SERVICE_CONNECT_AUTHORIZAION_FAILURE

Node '%1' failed to establish a communication session while joining the cluster.
This was due to an authorization failure. Please verify that the nodes are
running compatible versions of the cluster service software.

Event 1572: SERVICE_NETFT_ROUTE_INITIAL_FAILURE

Node '%1' failed to join the cluster because it could not send and receive
failure detection network messages with other cluster nodes. Please run the
Validate a Configuration wizard to ensure network settings. Also verify the
Windows Firewall 'Failover Clusters' rules.

Event 1574: DM_DATABASE_UNLOAD_FAILED

The failover cluster database could not be unloaded. If restarting the cluster
service does not fix the problem, please restart the machine.

Event 1575: DM_DATABASE_CORRUPT_OR_MISSING_FIXQUORUM

An attempt to forcibly start the cluster service has failed because the cluster
configuration data on this node is either missing or corrupt. Please first start
the cluster service on another node that has an intact and valid copy of the
cluster configuration data. Then, reattempt the start operation on this node
(which will attempt to obtain updated valid configuration information
automatically). If no other node is available, please use WBAdmin.msc to perform
a System State Restore of this node in order to restore the configuration data.

Event 1593: DM_COULD_NOT_DISCARD_CHANGES

The failover cluster database could not be unloaded and any potentially
incorrect changes in memory could not be discarded. The cluster service will
attempt to repair the database by retrieving it from another cluster node. If
the cluster service does not come online, restart the cluster service on this
node. If restarting the cluster service does not fix the problem, please restart
the machine. If the cluster service fails to come online after a reboot, please
restore the cluster database from the last backup. The current database was
copied to '%1'. If no backups are available, please copy '%1' to '%2' and
attempt to start the cluster service. If the cluster service then comes online
on this node, some cluster configuration changes may be lost and the cluster may
not function properly. Run the Validate a Configuration wizard to check your
cluster configuration and verify that the hosted Services and Applications are
online and functioning correctly.

Event 1672: EVENT_NODE_QUARANTINED

Cluster node '%1' has been quarantined. The node experienced '%2' consecutive
failures within a short amount of time and has been removed from the cluster to
avoid further disruptions. The node will be quarantined until '%3' and then the
node will automatically attempt to re-join the cluster.

Refer to the System and Application event logs to determine the issues on this
node. When the issue is resolved, quarantine can be manually cleared to allow
the node to rejoin with the 'Start-ClusterNode -ClearQuarantine' Windows
PowerShell cmdlet.

Node Name : %1

Number of consecutive cluster membership loses: %2

Time quarantine will be automatically cleared: %3

Error events

Event 1024: CP_REG_CKPT_RESTORE_FAILED

The registry checkpoint for cluster resource '%1' could not be restored to
registry key HKEY_LOCAL_MACHINE\%2. The resource may not function correctly.
Make sure that no other processes have open handles to registry keys in this
registry subtree.

Event 1034: RES_DISK_MISSING

Cluster physical disk resource '%1' cannot be brought online because the
associated disk could not be found. The expected signature of the disk was '%2'.
If the disk was replaced or restored, in the Failover Cluster Manager snap-in,
you can use the Repair function (in the properties sheet for the disk) to repair
the new or restored disk. If the disk will not be replaced, delete the
associated disk resource.

Event 1035: RES_DISK_MOUNT_FAILED

While disk resource '%1' was being brought online, access to one or more volumes
failed with error '%2'. Run the Validate a Configuration wizard to check your
storage configuration. Optionally you may want to run Chkdsk to verify the
integrity of all volumes on this disk.

Event 1037: RES_DISK_FILESYSTEM_FAILED

The file system for one or more partitions on the disk for resource '%1' may be
corrupt. Run the Validate a Configuration wizard to check your storage
configuration. Optionally, you may want to run Chkdsk to verify the integrity of
all volumes on this disk.

Event 1038: RES_DISK_RESERVATION_LOST

Ownership of cluster disk '%1' has been unexpectedly lost by this node. Run the
Validate a Configuration wizard to check your storage configuration.

Event 1039: RES_GENAPP_CREATE_FAILED

Generic application '%1' could not be brought online (with error '%2') during an
attempt to create the process. Possible causes include: the application may not
be present on this node, the path name may have been specified incorrectly, the
binary name may have been specified incorrectly.

Event 1040: RES_GENSVC_OPEN_FAILED

Generic service '%1' could not be brought online (with error '%2') during an
attempt to open the service. Possible causes include: the service is either not
installed or the specified service name is invalid.

Event 1041: RES_GENSVC_START_FAILED

Generic service '%1' could not be brought online (with error '%2') during an
attempt to start the service. Possible cause: the specified service parameters
might be invalid.

Event 1042: RES_GENSVC_FAILED_AFTER_START

Generic service '%1' failed with error '%2'. Please examine the application
event log.

Event 1044: RES_IPADDR_NBT_INTERFACE_CREATE_FAILED

Encountered a failure when attempting to create a new NetBIOS interface while
bringing resource '%1' online (error code '%2'). The maximum number of NetBIOS
names may have been exceeded.

Event 1046: RES_IPADDR_INVALID_SUBNET

Cluster IP address resource '%1' cannot be brought online because the subnet
mask value is invalid. Please check your IP address resource properties.

Event 1047: RES_IPADDR_INVALID_ADDRESS

Cluster IP address resource '%1' cannot be brought online because the address
value is invalid. Please check your IP address resource properties.

Event 1048: RES_IPADDR_INVALID_ADAPTER

Cluster IP address resource '%1' failed to come online. Configuration data for
the network adapter corresponding to cluster network interface '%2' could not be
determined (error code was '%3'). Please check that the IP address resource is
configured with the correct address and network properties.

Event 1049: RES_IPADDR_IN_USE

Cluster IP address resource '%1' cannot be brought online because a duplicate IP
address '%2' was detected on the network. Please ensure all IP addresses are
unique.

Event 1050: RES_NETNAME_DUPLICATE

Cluster network name resource '%1' cannot be brought online because name '%2'
matches this cluster node name. Ensure that network names are unique.

Event 1051: RES_NETNAME_NO_IP_ADDRESS

Cluster network name resource '%1' cannot be brought online. Ensure that the
network adapters for dependent IP address resources have access to at least one
DNS server. Alternatively, enable NetBIOS for dependent IP addresses.

Event 1052: RES_NETNAME_CANT_ADD_NAME_STATUS

Cluster Network Name resource '%1' cannot be brought online because the name
could not be added to the system. The associated error code is stored in the
data section.

Event 1053: RES_SMB_CANT_CREATE_SHARE

Cluster File Share '%1' cannot be brought online because the share could not be
created.

Event 1054: RES_SMB_SHARE_NOT_FOUND

Health check for file share resource '%1' failed. Retrieving information for
share '%2' (scoped to network name %3) returned error code '%4'. Ensure the
share exists and is accessible.

Event 1055: RES_SMB_SHARE_FAILED

Health check for file share resource '%1' failed. Retrieving information for
share '%2' (scoped to network name %3) indicated that the share does not exist
(error code '%4'). Please ensure the share exists and is accessible.

Event 1069: RCM_RESOURCE_FAILURE

Cluster resource '%1' in clustered role '%2' failed.

Event 1069: RCM_RESOURCE_FAILURE_WITH_TYPENAME

Cluster resource '%1' of type '%3' in clustered role '%2' failed.

Based on the failure policies for the resource and role, the cluster service may try to
bring the resource online on this node or move the group to another node of the
cluster and then restart it. Check the resource and group state using Failover
Cluster Manager or the Get-ClusterResource Windows PowerShell cmdlet.

Event 1069: RCM_RESOURCE_FAILURE_WITH_CAUSE

Cluster resource '%1' of type '%3' in clustered role '%2' failed. The error code
was '%5' ('%4').

Based on the failure policies for the resource and role, the
cluster service may try to bring the resource online on this node or move the
group to another node of the cluster and then restart it. Check the resource and
group state using Failover Cluster Manager or the Get-ClusterResource Windows
PowerShell cmdlet.

Event 1069: RCM_RESOURCE_FAILURE_WITH_ERROR_CODE

Cluster resource '%1' of type '%3' in clustered role '%2' failed. The error code
was '%4'.

Based on the failure policies for the resource and role, the
cluster service may try to bring the resource online on this node or move the
group to another node of the cluster and then restart it. Check the resource and
group state using Failover Cluster Manager or the Get-ClusterResource Windows
PowerShell cmdlet.

Event 1069: RCM_RESOURCE_FAILURE_DUE_TO_VETO

Cluster resource '%1' of type '%3' in clustered role '%2' failed due to an
attempt to block a required state change in that cluster resource.

Event 1077: RES_IPADDR_IPV4_ADDRESS_INTERFACE_FAILED

Health check for IP interface '%1' (address '%2') failed (status is '%3'). Run
the Validate a Configuration wizard to ensure that the network adapter is
functioning properly.

Event 1078: RES_IPADDR_WINS_ADDRESS_FAILED

Cluster IP address resource '%1' cannot be brought online because WINS
registration failed on interface '%2' with error '%3'. Ensure that a valid,
accessible WINS server has been specified.

Event 1121: CP_CRYPTO_CKPT_RESTORE_FAILED

Encrypted settings for cluster resource '%1' could not be successfully applied
to the container name '%2' on this node.

Event 1127: TM_EVENT_CLUSTER_NETINTERFACE_FAILED

Cluster network interface '%1' for cluster node '%2' on network '%3' failed. Run
the Validate a Configuration wizard to check your network configuration. If the
condition persists, check for hardware or software errors related to the network
adapter. Also check for failures in any other network components to which the
node is connected such as hubs, switches, or bridges.

Event 1129: TM_EVENT_CLUSTER_NETWORK_PARTITIONED

Cluster network '%1' is partitioned. Some attached failover cluster nodes cannot
communicate with each other over the network. The failover cluster was not able
to determine the location of the failure. Run the Validate a Configuration
wizard to check your network configuration. If the condition persists, check for
hardware or software errors related to the network adapter. Also check for
failures in any other network components to which the node is connected such as
hubs, switches, or bridges.

Event 1130: TM_EVENT_CLUSTER_NETWORK_DOWN

Cluster network '%1' is down. None of the available nodes can communicate using
this network. Run the Validate a Configuration wizard to check your network
configuration. If the condition persists, check for hardware or software errors
related to the network adapter. Also check for failures in any other network
components to which the node is connected such as hubs, switches, or bridges.

Event 1137: RCM_DRAIN_MOVE_FAILED

Move of cluster role '%1' for drain could not be completed. The operation failed
with error code %2.

Event 1138: RES_SMB_CANT_CREATE_DFS_ROOT

Cluster file share resource '%1' cannot be brought online. Creation of DFS
namespace root failed with error '%3'. This may be due to failure to start the
'DFS Namespace' service or failure to create the DFS-N root for share '%2'.

Event 1141: RES_SMB_CANT_INIT_DFS_SVC

Cluster file share resource '%1' cannot be brought online. Resynchronization of
DFS root target '%2' failed with error '%3'.

Event 1142: RES_SMB_CANT_ONLINE_DFS_ROOT

Cluster file share resource '%1' for DFS Namespace cannot be brought online due
to error '%2'.

Event 1182: NETRES_RESOURCE_STOP_ERROR

Cluster resource '%1' cannot be brought online because the associated service
failed an attempted restart. The error code is '%2'. The service required a
restart in order to update parameters. However, the service failed before it
could be stopped and restarted. Please check for additional events associated
with the service and ensure the service is functioning correctly.

Event 1183: RES_DISK_INVALID_MP_SOURCE_NOT_CLUSTERED

Cluster disk resource '%1' contains an invalid mount point. Both the source and
target disks associated with the mount point must be clustered disks, and must
be members of the same group.

Mount point '%2' for volume '%3' references an
invalid source disk. Please ensure that the source disk is also a clustered disk
and in the same group as the target disk (hosting the mount point).

Event 1191: RES_NETNAME_DELETE_COMPUTER_ACCOUNT_FAILED_STATUS

Cluster network name resource '%1' failed to delete its associated computer
object in domain '%2'. The error code was '%3'.

Please have a domain administrator manually delete the computer object from the Active Directory domain.

Event 1192: RES_NETNAME_DELETE_COMPUTER_ACCOUNT_FAILED

Cluster network name resource '%1' failed to delete its associated computer
object in domain '%2' for the following reason: %3.

Please have a domain administrator manually delete the computer object from the Active Directory domain.

Event 1193: RES_NETNAME_ADD_COMPUTER_ACCOUNT_FAILED_STATUS

Cluster network name resource '%1' failed to create its associated computer
object in domain '%2' for the following reason: %3.

The associated error code is: %5

Please work with your domain administrator to ensure that:

- The cluster identity '%4' can create computer objects. By default all computer
objects are created in the 'Computers' container; consult the domain
administrator if this location has been changed.
- The quota for computer objects has not been reached.
- If there is an existing computer object, verify
the Cluster Identity '%4' has 'Full Control' permission to that computer object
using the Active Directory Users and Computers tool.

Event 1194: RES_NETNAME_ADD_COMPUTER_ACCOUNT_FAILED

Cluster network name resource '%1' failed to create its associated computer
object in domain '%2' during: %3.

The text for the associated error code is: %4

Please work with your domain administrator to ensure that:

- The cluster identity '%5' has Create Computer Objects permissions. By default all computer
objects are created in the same container as the cluster identity '%5'.
- The quota for computer objects has not been reached.
- If there is an existing computer object, verify the Cluster Identity '%5' has 'Full Control' permission
to that computer object using the Active Directory Users and Computers tool.

Event 1195: RES_NETNAME_DNS_REGISTRATION_FAILED_STATUS

Cluster network name resource '%1' failed registration of one or more associated
DNS name(s). The error code was '%2'. Ensure that the network adapters
associated with dependent IP address resources are configured with access to at
least one DNS server.

Event 1196: RES_NETNAME_DNS_REGISTRATION_FAILED

Cluster network name resource '%1' failed registration of one or more associated
DNS name(s) for the following reason: %2.

Ensure that the network adapters associated with dependent IP address resources are configured with at least one accessible DNS server.

Event 1205: RCM_EVENT_GROUP_FAILED_ONLINE_OFFLINE

The Cluster service failed to bring clustered role '%1' completely online or
offline. One or more resources may be in a failed state. This may impact the
availability of the clustered role.

Event 1206: RES_NETNAME_UPDATE_COMPUTER_ACCOUNT_FAILED_STATUS

The computer object associated with the cluster network name resource '%1' could not be updated in domain '%2'. The error code was '%3'. The cluster identity '%4' may lack permissions required to update the object. Please work with your domain administrator to ensure that the cluster identity can update computer objects in the domain.

Event 1207: RES_NETNAME_UPDATE_COMPUTER_ACCOUNT_FAILED

The computer object associated with the cluster network name resource '%1' could
not be updated in domain '%2' during the %3 operation.

The text for the associated error code is: %4

The cluster identity '%5' may lack permissions required to update the object. Please work with your domain administrator to ensure that the cluster identity can update computer objects in the domain.

Event 1208: RES_DISK_INVALID_MP_TARGET_NOT_CLUSTERED

Cluster disk resource '%1' contains an invalid mount point. Both the source and
target disks associated with the mount point must be clustered disks, and must
be members of the same group.

Mount point '%2' for volume '%3' references an invalid target disk. Please ensure that the target disk is also a clustered disk and in the same group as the source disk (hosting the mount point).

Event 1211: RES_NETNAME_NO_WRITEABLE_DC_STATUS

Cluster network name resource '%1' cannot be brought online. Attempt to locate a
writeable domain controller (in domain %2) in order to create or update a
computer object associated with the resource failed. The error code was '%3'.
Ensure that a writeable domain controller is accessible to this node within the
configured domain. Also ensure that the DNS server is running in order to
resolve the name of the domain controller.

Event 1212: RES_NETNAME_NO_WRITEABLE_DC

Cluster network name resource '%1' cannot be brought online. Attempt to locate a
writeable domain controller (in domain %2) in order to create or update a
computer object associated with the resource failed for the following
reason: %3.

The error code was '%4'. Ensure that a writeable domain
controller is accessible to this node within the configured domain. Also ensure
that the DNS server is running in order to resolve the name of the domain
controller.

Event 1213: RES_NETNAME_RENAME_RESTORE_FAILED

Cluster network name resource '%1' could not completely rename the associated
computer object on domain controller '%2'. Attempting to rename the computer
object from new name '%3' back to its original name '%4' has also failed. The
error code was '%5'. This may affect client connectivity until the network name
and its associated computer object name are consistent. Contact your domain
administrator to manually rename the computer object.

Event 1214: RES_NETNAME_CANT_ADD_NAME2

Cluster Network Name resource cannot be registered with Netbios.

Network Name: '%3'  
Reason for failure: %2  
Resource name:'%1'

Run nbtstat for the network name to ensure that the name is not already registered with Netbios.

Event 1215: RES_NETNAME_NOT_REGISTERED_WITH_RDR

Cluster network name resource '%1' failed a health check. Network name '%2' is
no longer registered on this node. The error code was '%3'. Check for hardware
or software errors related to the network adapter. Also, you can run the
Validate a Configuration wizard to check your network configuration.

Event 1218: RES_NETNAME_ONLINE_RENAME_RECOVERY_MISSING_ACCOUNT

Cluster network name resource '%1' failed to perform a name change operation
(attempting to change original name '%3' to name '%4'). The computer object
could not be found on the domain controller '%2' (where it was created). An
attempt will be made to recreate the computer object the next time the resource
is brought online. Additionally, please work with your domain administrator to
ensure that the computer object exists in the domain.

Event 1219: RES_NETNAME_ONLINE_RENAME_DC_NOT_FOUND

Cluster network name resource '%1' failed to perform a name change operation.
The domain controller '%2' where computer object '%3' was being renamed, could
not be contacted. The error code was '%4'. Ensure a writeable domain controller
is accessible and check for any connectivity issue.

Event 1220: RES_NETNAME_ONLINE_RENAME_RECOVERY_FAILED

The computer account for resource '%1' failed to be renamed from %2 to %3 using
Domain Controller %4. The associated error code is stored in the data section.

The computer account for this resource was in the process of being renamed and
did not complete. This was detected during the online process for this resource.
In order to recover, the computer account must be renamed to the current value
of the Name property, i.e., the name presented on the network.

The Domain Controller where the renamed was attempted might not be available; if this is
the case, wait for the Domain Controller to be available again. The Domain
Controller could be denying access to the account; after resolving access, try
to bring the name online again.

If this is not possible, disable and re-enable Kerberos Authentication and an attempt will be made to find the computer account on a different DC. You need to change the Name property to %2
in order to use the existing computer account.

Event 1223: RES_IPADDR_INVALID_NETWORK_ROLE

Cluster IP address resource '%1' cannot be brought online because the cluster
network '%2' is not configured to allow client access. Please use the Failover
Cluster Manager snap-in to check the configured properties of the cluster
network.

Event 1226: RES_NETNAME_TCB_NOT_HELD

Network Name resource '%1' (with associated network name '%2') has Kerberos
Authentication support enabled. Failed to add required credentials to the LSA -
the associated error code '%3' indicates insufficient privileges normally
required for this operation. The required privilege is 'Trusted Computing Base'
and must be locally enabled on each node comprising the cluster.

Event 1227: RES_NETNAME_LSA_ERROR

Network Name resource '%1' (with associated network name '%2') has Kerberos
Authentication support enabled. Failed to add required credentials to the LSA -
the associated error code is '%3'.

Event 1228: RES_NETNAME_CLONE_FAILURE

Cluster network name resource '%1' encountered an error enabling the network
name on this node. The reason for the failure was: '%2'.

The error code was '%3'.

You may take the network name resource offline and online again to retry.

Event 1229: RES_NETNAME_NO_IPS_FOR_DNS

Cluster network name resource '%1' was unable to identify any IP addresses to
register with a DNS server. Ensure that there is one or more networks that are
enabled for cluster use with the 'Allow clients to connect through this network'
setting, and that each node has a valid IP address configured for the networks.

Event 1230: RCM_DEADLOCK_OR_CRASH_DETECTED

A component on the server did not respond in a timely fashion. This caused the
cluster resource '%1' (resource type '%2', DLL '%3') to exceed its time-out
threshold. As part of cluster health detection, recovery actions will be taken.
The cluster will try to automatically recover by terminating and restarting the
Resource Hosting Subsystem (RHS) process that is running this resource. Verify
that the underlying infrastructure (such as storage, networking, or services)
that are associated with the resource are functioning correctly.

Event 1230: RCM_RESOURCE_CONTROL_DEADLOCK_DETECTED

A component on the server did not respond in a timely fashion. This caused the
cluster resource '%1' (resource type '%2', DLL '%3') to exceed its time-out
threshold while processing control code '%4;'. As part of cluster health
detection, recovery actions will be taken. The cluster will try to automatically
recover by terminating and restarting the Resource Hosting Subsystem (RHS)
process that is running this resource. Verify that the underlying infrastructure
(such as storage, networking, or services) that are associated with the resource
are functioning correctly.

Event 1231: RES_NETNAME_LOGON_FAILURE

Cluster network name resource '%1' encountered an error logging on to the
domain. The reason for the failure was: '%2'.

The error code was '%3'.

Ensure that a domain controller is accessible to this node within the
configured domain.

Event 1232: RES_GENSCRIPT_TIMEOUT

Entry point '%2' in cluster generic script resource '%1' did not complete
execution in a timely manner. This could be due to an infinite loop or other
issues possibly resulting in an infinite wait. Alternatively, the specified
pending timeout value may be too short for this resource. Please review the '%2'
script entry point to ensure all possible infinite waits in the script code have
been corrected. Then, consider increasing the pending timeout value if deemed
necessary.

Event 1233: RES_GENSCRIPT_HANGMODE

Cluster generic script resource '%1': request to perform the '%2' operation will
not be processed. This is due to a previously failed attempt to execute the '%3'
entry point in a timely fashion. Please review the script code for this entry
point to ensure there does not exist any infinite loop or other issues possibly
resulting in an infinite wait. Then, consider increasing the resource pending
timeout value if deemed necessary.

Event 1234: CLUSTER_EVENT_ACCOUNT_MISSING_PRIVS

The Cluster service has detected that its service account is missing one or more
of the required privileges. The missing privilege list is: '%1' and is not
currently granted to the service account. Use the 'sc.exe qprivs clussvc' to
verify the privileges of the Cluster service (ClusSvc). Additionally check for
any security policies or group policies in Active Directory Domain Services that
may have altered the default privileges. Type the following command to grant the
Cluster service the necessary privileges to function correctly:

sc.exe privs
clussvc
SeBackupPrivilege/SeRestorePrivilege/SeIncreaseQuotaPrivilege/SeIncreaseBasePriorityPrivilege/SeTcbPrivilege/SeDebugPrivilege/SeSecurityPrivilege/SeAuditPrivilege/SeImpersonatePrivilege/SeChangeNotifyPrivilege/SeIncreaseWorkingSetPrivilege/SeManageVolumePrivilege/SeCreateSymbolicLinkPrivilege/SeLoadDriverPrivilege

Event 1242: RES_IPADDR_LEASE_EXPIRED

Lease of IP address '%2' associated with cluster IP address resource '%1' has
expired or is about to expire, and currently cannot be renewed. Ensure that the
associated DHCP server is accessible and properly configured to renew the lease
on this IP address.

Event 1245: RES_IPADDR_LEASE_RENEWAL_FAILED

Cluster IP address resource '%1' failed to renew the lease for IP address '%2'.
Ensure that the DHCP server is accessible and properly configured to renew the
lease on this IP address.

Event 1250: RCM_RESOURCE_EMBEDDED_FAILURE

Cluster resource '%1' in clustered role '%2' has received a critical state
notification. For a virtual machine this indicates that an application or
service inside the virtual machine is in an unhealthy state. Verify the
functionality of the service or application being monitored within the virtual
machine.

Event 1254: RCM_GROUP_TERMINAL_FAILURE

Clustered role '%1' has exceeded its failover threshold. It has exhausted the
configured number of failover attempts within the failover period of time
allotted to it and will be left in a failed state. No additional attempts will
be made to bring the role online or fail it over to another node in the cluster.
Please check the events associated with the failure. After the issues causing
the failure are resolved the role can be brought online manually or the cluster
may attempt to bring it online again after the restart delay period.

Event 1255: RCM_RESOURCE_NETWORK_FAILURE

Cluster resource '%1' in clustered role '%2' has received a critical state
notification. For a virtual machine this indicates that a critical network of
the virtual machine is in an unhealthy state. Verify the network connectivity of
the virtual machine and the virtual networks that the virtual machine is
configured to use.

Event 1256: RES_NETNAME_DNS_REGISTRATION_FAILED_DYNAMIC_DNS_ZONE

Cluster network name resource failed registration of one or more associated DNS
names(s) because the corresponding DNS Zone does not accept dynamic
updates.

Cluster Network name: '%1'  
DNS Zone: '%2'

Guidance

Ensure that the DNS is configured as a Dynamic DNS zone. If the DNS server does not accept dynamic updates uncheck the 'Register this connection's' addresses in DNS' in the properties of the network adapter.

Event 1257: RES_NETNAME_DNS_REGISTRATION_FAILED_SECURE_DNS_ZONE

Cluster network name resource failed registration of one or more associated DNS
names(s) because the access to update the secure DNS Zone was denied.

Cluster Network name: '%1'  
DNS Zone: '%2'

Ensure that cluster name object (CNO) is
granted permissions to the Secure DNS Zone.

Event 1258: RES_NETNAME_DNS_REGISTRATION_FAILED_TIMEOUT

Cluster network name resource failed registration of one or more associated DNS
name(s) because the a DNS server could not be reached.

Cluster Network name: '%1'  
DNS Zone: '%2'  
DNS Server: '%3'

Ensure that the network adapters
associated with dependent IP address resources are configured with at least one
accessible DNS server.

Event 1259: RES_NETNAME_DNS_REGISTRATION_FAILED_CLEANUP

Cluster network name resource failed registration of one or more associated DNS
name(s) because the cluster service failed clean up the existing records
corresponding to the network name.

Cluster Network name: '%1'  
DNS Zone: '%2'

Ensure that cluster name object (CNO) is granted permissions to the
Secure DNS Zone.

Event 1260: RES_NETNAME_DNS_REGISTRATION_MODIFY_FAILED

Cluster network name resource failed to modify the DNS registration.

Cluster Network name: '%1'  
Error code: '%2'

Guidance

Ensure that the network adapters associated with dependent IP address resources are configured with access to at least one DNS server.

Event 1261: RES_NETNAME_DNS_REGISTRATION_MODIFY_FAILED_STATUS

Cluster network name resource failed to modify the DNS registration.

Cluster Network name: '%1'  
Reason: '%2'

Guidance

Ensure that the network adapters associated with dependent IP address resources are configured with access to at least one DNS server.

Event 1262: RES_NETNAME_DNS_REGISTRATION_PUBLISH_PTR_FAILED

Cluster network name resource failed to publish the PTR record in the DNS
reverse lookup zone.

Cluster Network name: '%1'  
Error Code: '%2'

Guidance

Ensure that the network adapters associated with dependent IP address resources are configured with access to at least one DNS server and that the DNS reverse lookup zone exists.

Event 1264: RES_NETNAME_DNS_REGISTRATION_PUBLISH_PTR_FAILED_STATUS

Cluster network name resource failed to publish the PTR record in the DNS
reverse lookup zone.

Cluster Network name: '%1'  
Reason: '%2'

Guidance

Ensure that the network adapters associated with dependent IP address resources are configured with access to at least one DNS server and that the DNS reverse lookup zone exists.

Event 1265: RES_TYPE_CONTROL_TIMED_OUT

Cluster resource type '%1' timed out while processing the control code %2. The
cluster will try to automatically recover by terminating and restarting the
Resource Hosting Subsystem (RHS) process that was processing the call.

Event 1289: NETFT_ADAPTER_NOT_FOUND

The Cluster Service was unable to access network adapter '%1'. Verify that other
network adapters are functioning properly and check the device manager for
errors associated with adapter '%1'. If the configuration for adapter '%1' has
been changed, it may become necessary to reinstall the failover clustering
feature on this computer.

Event 1360: RES_IPADDR_INVALID_NETWORK

Cluster IP address resource '%1' failed to come online. Ensure the network
property '%2' matches a cluster network name or the address property '%3'
matches one of the subnets on a cluster network. If this is an IPv6 Address
type, please verify that the cluster network matching this resource has at least
one IPv6 prefix that is not link-local or tunnel.

Event 1361: RES_IPADDR_MISSING_DEPENDANT

IPv6 Tunnel address resource '%1' failed to come online because it does not
depend on an IP Address (IPv4) resource. Dependency on at least one IP Address
(IPv4) resource is required.

Event 1362: RES_IPADDR_MISSING_DATA

Cluster IP address resource '%1' failed to come online because the '%2' property
could not be read. Please ensure that the resource is correctly configured.

Event 1363: RES_IPADDR_NO_ISATAP_SUPPORT

IPv6 tunnel address resource '%1' failed to come online. Cluster network '%2'
associated with dependent IP address (IPv4) resource '%3' does not support
ISATAP tunneling. Please ensure that the cluster network supports ISATAP
tunneling.

Event 1540: SERVICE_BACKUP_NOQUORUM

The backup operation for the cluster configuration data has been aborted because
quorum for the cluster has not yet been achieved. Please retry this backup
operation after the cluster achieves quorum.

Event 1554: SERVICE_RESTORE_INVALIDUSER

The restore operation for the cluster configuration data has failed. This was
due to insufficient privileges associated with the user account performing the
restore. Please ensure that the user account has local administrator privileges.

Event 1557: SERVICE_WITNESS_ATTACH_FAILED

Cluster service failed to update the cluster configuration data on the witness
resource. Please ensure that the witness resource is online and accessible.

Event 1559: RES_WITNESS_NEW_NODE_CONFLICT

File share '%1' associated with the file share witness resource is currently
hosted by server '%2'. This server '%2' has just been added as a new node within
the failover cluster. Hosting of the file share witness by any node comprising
the same cluster is not recommended. Please choose a file share witness that is
not hosted by any node within the same cluster and modify settings of the file
share witness resource accordingly.

Event 1560: RES_SMB_SHARE_CONFLICT

Cluster file share resource '%1' has detected shared folder conflicts. As a
result, some of these shared folders may not be accessible. To rectify this
situation, ensure multiple shared folders do not have the same share name.

Event 1563: RES_FSW_ONLINEFAILURE

File share witness resource '%1' failed to come online. Please ensure that file
share '%2' exists and is accessible by the cluster.

Event 1566: RES_NETNAME_TIMEDOUT

Cluster network name resource '%1' cannot be brought online. The network name
resource was terminated by the resource host subsystem because it did not
complete an operation in an acceptable time. The operation timed out while
performing: '%2'

Event 1567: SERVICE_FAILED_TO_CHANGE_LOG_SIZE

Cluster service failed to change the trace log size. Please verify the
ClusterLogSize setting with the 'Get-Cluster \| Format-List \*' PowerShell
cmdlet. Also, use the Performance Monitor snap-in to verify the event trace
session settings for FailoverClustering.

Event 1567: RES_VIPADDR_ADDRESS_INTERFACE_FAILED

Health check for IP interface '%1'(address '%2') failed (status is '%3'). Check
for hardware or software errors related to the physical or virtual network
adapters.

Event 1568: RES_CLOUD_WITNESS_CANT_COMMUNICATE_TO_AZURE

Cloud witness resource could not reach Microsoft Azure storage
services.

Cluster resource: %1  
Cluster node: %2

Guidance

This could be due to network communication between the cluster node and the Microsoft Azure service being blocked. Verify the node's internet connectivity to Microsoft Azure. Connect to the Microsoft Azure portal and verify that the storage account exists.

Event 1569: SERVICE_USING_RESTRICTED_NETWORK

Network '%1' which has been disabled for failover cluster use, was found to be
the only currently possible network that node '%2' can use to communicate with
other nodes in the cluster. This may impact the node's ability to participate in
the cluster. Please verify network connectivity of node '%2' and enable at least
one network for cluster communication. Run the Validate a Configuration wizard
to check your network configuration.

Event 1569: RES_CLOUD_WITNESS_TOKEN_EXPIRED

Cloud witness resource failed to authenticate with Microsoft Azure storage
services. An access denied error was returned while attempting to contact the
Microsoft Azure storage account.

Cluster resource: %1

Guidance

The storage account's access key may no longer be valid. Use the Configure Cluster Quorum Wizard in the Failover Cluster Manager or the Set-ClusterQuorum Windows PowerShell cmdlet, to configure the Cloud witness resource with the updated storage account access key.

Event 1573: SERVICE_FORM_WITNESS_FAILED

Node '%1' failed to form a cluster. This was because the witness was not
accessible. Please ensure that the witness resource is online and available.

Event 1580: RES_NETNAME_DNS_REGISTRATION_SECURE_ZONE_FAILED

Cluster network name resource '%1' failed to register the name '%2' over adapter
'%4' in a secure DNS zone. This was due to an existing record with this name and
the cluster identity does not have the sufficient privileges to update that
record. The error code was '%3'. Please contact your DNS server administrator to
verify the cluster identity has permissions on DNS record '%2'.

Event 1585: RES_FILESERVER_FSCHECK_SRVSVC_STOPPED

Cluster file server resource '%1' failed a health check. This was due to the
Server service not being started. Please use Server Manager to confirm the state
of the Server service on this cluster node.

Event 1586: RES_FILESERVER_FSCHECK_SCOPED_NAME_NOT_REGISTERED

Cluster file server resource '%1' failed a health check. This was because some
of its shared folders were inaccessible. Verify that the folders are accessible
from clients. Additionally, confirm the state of the Server service on this
cluster node using Server Manager and look for other events related to the
Server service on this cluster node. It may be necessary to restart the network
name resource '%2' in this clustered role.

Event 1587: RES_FILESERVER_FSCHECK_FAILED

Cluster file server resource '%1' failed a health check. This was because some
of its shared folders were inaccessible. Verify that the folders are accessible
from clients. Additionally, confirm the state of the Server service on this
cluster node using Server Manager and look for other events related to the
Server service on this cluster node.

Event 1588: RES_FILESERVER_SHARE_CANT_ADD

Cluster file server resource '%1' cannot be brought online. The resource failed
to create file share '%2' associated with network name '%3'. The error code was
'%4'. Verify that the folders exist and are accessible. Additionally, confirm
the state of the Server service on this cluster node using Server Manager and
look for other related events on this cluster node. It may be necessary to
restart the network name resource '%3' in this clustered role.

Event 1600: CLUSAPI_CREATE_CANNOT_SET_AD_DACL

Cluster service failed to set the permissions on the cluster computer object
'%1'. Please contact your network administrator to check the cluster security
descriptor of the computer object in Active Directory, verify that the DACL is
not too big, and remove any unnecessary extra ACE(s) on the object if necessary.

Event 1603: RES_FILESERVER_CLONE_FAILED

File Server could not start because expected dependency on 'Network Name'
resource was not found or it was not configured properly. Error=0x%2.

Event 1606: RES_DISK_CNO_CHECK_FAILED

Cluster disk resource '%1' contains a BitLocker-protected volume, '%2', but for
this volume, the Active Directory cluster name account (also called the cluster
name object or CNO) is not a BitLocker protector for the volume. This is
required for BitLocker-protected volumes. To correct this, first remove the disk
from the cluster. Next, use the Manage-bde.exe command-line tool to add the
cluster name as an ADAccountOrGroup protector, using the format
domain\ClusterName$ for the cluster name. Then add the disk back to the
cluster. For more information, see the documentation for Manage-bde.exe

Event 1607: RES_DISK_CNO_UNLOCK_FAILED

Cluster disk resource '%1' was unable to unlock the BitLocker-protected volume
'%2'. The cluster name object (CNO) is not set to be a valid BitLocker protector
for this volume. To correct this, remove the disk from the cluster. Then use the
Manage-bde.exe command-line tool to add the cluster name as an ADAccountOrGroup
protector, using the format domain\ClusterName$, and add the disk back to the
cluster. For more information, see the documentation for Manage-bde.exe.

Event 1608: RES_FILESERVER_LEADER_FAILED

File Server could not start because expected dependency on 'Network Name'
resource was not found or it was not configured properly. Error=0x%2.

Event 1609: RES_SODA_FILESERVER_LEADER_FAILED

Scale Out File Server could not start because expected dependency on
'Distributed Network Name' resource was not found or it was not configured
properly. Error=0x%2.

Event 1632: CLUSAPI_CREATE_MISMATCHED_OU

The creation of the cluster failed. Unable to create the cluster name object
'%1' in active directory organizational unit '%2'. The object already exists in
organizational unit '%3'. Verify that the specified distinguished name path and
the cluster name object are correct. If the distinguished name path is not
specified, the existing computer object '%1' will be used.

Event 1652: SERVICE_TCP_CONNECTION_FAILURE

Cluster node '%1' failed to join the cluster. A TCP connection could not be
established to node(s) '%2'. Verify network connectivity and configuration of
any network firewalls.

Event 1652: SERVICE_UDP_CONNECTION_FAILURE

Cluster node '%1' failed to join the cluster. A UDP connection could not be
established to node(s) '%2'. Verify network connectivity and configuration of
any network firewalls.

Event 1652: SERVICE_VIRTUAL_TCP_CONNECTION_FAILURE

Cluster node '%1' failed to join the cluster. A TCP connection using the
Microsoft Failover Cluster Virtual Adapter could not be established to node(s)
'%2'. Verify network connectivity and configuration of any network firewalls.

Event 1653: SERVICE_NO_CONNECTIVITY

Cluster node '%1' failed to join the cluster because it could not communicate
over the network with any other node in the cluster. Verify network connectivity
and configuration of any network firewalls.

Event 1654: RES_VIPADDR_INVALID_ADAPTERNAME

Cluster Disjoint IP address resource '%1' failed to come online. Configuration
data for the network adapter corresponding to network adapter '%2' could not be
determined (error code was '%3'). Check that the IP address resource is
configured with the correct address and network properties.

Event 1655: RES_VIPADDR_INVALID_VSID

Cluster Disjoint IP address resource '%1' failed to come online. Configuration
data for the network adapter corresponding to Virtual Subnet Id '%2' and Routing
Domain Id '%3' could not be determined (error code was '%4'). Check that the IP
address resource is configured with the correct address and network properties.

Event 1656: RES_VIPADDR_ADDRESS_CREATE_FAILED

Failed to add the IP Address '%2' for Disjoint IP address resource '%1' (error
code was '%3'). Check for hardware or software errors related to the physical or
virtual network adapters.

Event 1664: CLUSTER_UPGRADE_INCOMPLETE

Upgrading the functional level of the cluster failed. Check that all nodes of
the cluster are currently running and are the same version of Windows Server,
then run the Update-ClusterFunctionalLevel Windows PowerShell cmdlet again.

Event 1676: EVENT_LOCAL_NODE_QUARANTINED

Local cluster node has been quarantined by '%1'. The node will be quarantined
until '%2' and then the node will automatically attempt to re-join the cluster.

Refer to the System and Application event logs to determine the issues on
this node. When the issue is resolved, quarantine can be manually cleared to
allow the node to rejoin with the 'Start-ClusterNode -ClearQuarantine' Windows
PowerShell cmdlet.

QuarantineType : Quarantined by %1  
Time quarantine will be automatically cleared: %2

Event 1677: EVENT_NODE_DRAIN_FAILED

Node drain failed on Cluster node %1.

Reference the node's System and
Application event logs and cluster logs to investigate the cause of the drain
failure. When the problem is resolved, you can retry the drain operation.

Event 1683: RES_NETNAME_COMPUTER_ACCOUNT_NO_DC

The cluster service was unable to reach any available domain controller on the
domain. This may impact functionality that is dependent on Cluster network name
authentication.

DC Server: %1

Guidance

Verify that domain controllers are accessible on the network to the cluster nodes.

Event 1684: RES_NETNAME_COMPUTER_OBJECT_VCO_NOT_FOUND

Cluster network name resource failed to find the associated computer object in
Active Directory. This may impact functionality that is dependent on Cluster
network name authentication.

Network Name: %1  
Organizational Unit: %2

Guidance

Restore the computer object for the network name from the Active Directory recycle bin. Alternately, offline the cluster network name resource and run the Repair action to recreate the computer object in Active Directory.

Event 1685: RES_NETNAME_COMPUTER_OBJECT_CNO_NOT_FOUND

Cluster network name resource failed to find the associated computer object in
Active Directory. This may impact functionality that is dependent on Cluster
network name authentication.

Network Name: %1  
Organizational Unit: %2

Guidance

Restore the computer object for the network name from the Active Directory recycle bin.

Event 1686: RES_NETNAME_COMPUTER_OBJECT_VCO_DISABLED

Cluster network name resource found the associated computer object in Active
Directory to be disabled. This may impact functionality that is dependent on
Cluster network name authentication.

Network Name: %1  
Organizational Unit: %2

Guidance

Enable the computer object for the network name in Active Directory.

Event 1687: RES_NETNAME_COMPUTER_OBJECT_CNO_DISABLED

Cluster network name resource found the associated computer object in Active
Directory to be disabled. This may impact functionality that is dependent on
Cluster network name authentication.

Network Name: %1  
Organizational Unit: %2

Guidance

Enable the computer object for the network name in Active Directory. Alternately, offline the cluster network name resource and run the Repair action to enable the computer object in Active Directory.

Event 1688: RES_NETNAME_COMPUTER_OBJECT_FAILED

Cluster network name resource detected that the associated computer object in
Active Directory was disabled and failed in its attempt to enable it. This may
impact functionality that is dependent on Cluster network name
authentication.

Network Name: %1  
Organizational Unit: %2

Guidance

Enable the computer object for the network name in Active Directory.

Event 4608: NODECLEANUP_GET_CLUSTERED_DISKS_FAILED

Cluster service failed to retrieve the list of clustered disks while destroying
the cluster. The error code was '%1'. If these disks are not accessible, execute
the 'Clear-ClusterDiskReservation' PowerShell cmdlet.

Event 4611: NODECLEANUP_RELEASE_CLUSTERED_DISKS_FROM_PARTMGR_FAILED

Clustered disk with ID '%2' was not released by the Partition Manager while
destroying the cluster. The error code was '%1'. Restarting the machine will
ensure the disk is released by the Partition Manager.

Event 4613: NODECLEANUP_CLEAR_CLUSDISK_DATABASE_FAILED

The cluster service failed to properly cleanup a clustered disk with ID '%2'
while destroying the cluster. The error code was '%1'. You may unable to access
this disk until cleanup has been successfully completed. For manual cleanup,
delete the 'AttachedDisks' value of the
'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClusDisk\Parameters'
key in the Windows registry.

Event 4615: NODECLEANUP_DISABLE_CLUSTER_SERVICE_FAILED

The cluster service has been stopped and set as disabled as part of cluster node
cleanup.

Event 4616: NODECLEANUP_DISABLE_CLUSTER_SERVICE_TIMEOUT

Termination of the cluster service during cluster node cleanup has not completed
within the expected time period. Please restart this machine to ensure the
cluster service is no longer running.

Event 4618: NODECLEANUP_RESET_CLUSTER_REGISTRY_ENTRIES_FAILED

Resetting cluster service registry entries during cluster node cleanup failed.
The error code was '%1'. You may be unable to create or join a cluster with this
machine until cleanup has been successfully completed. For manual cleanup,
execute the 'Clear-ClusterNode' PowerShell cmdlet on this machine.

Event 4620: NODECLEANUP_UNLOAD_CLUSTER_HIVE_FAILED

Unloading the cluster service registry hive during cluster node cleanup failed.
The error code was '%1'. You may be unable to create or join a cluster with this
machine until cleanup has been successfully completed. For manual cleanup,
execute the 'Clear-ClusterNode' PowerShell cmdlet on this machine.

Event 4622: NODECLEANUP_ERRORS

The Cluster service encountered an error during node cleanup. You may be unable
to create or join a cluster with this machine until cleanup has been
successfully completed. Use the 'Clear-ClusterNode' PowerShell cmdlet on this
node.

Event 4624: NODECLEANUP_RESET_NLBSFLAGS_FAILED

Resetting the IPSec security association timeout registry value failed during
cluster node cleanup. The error code was '%1'. For manual cleanup, execute the
'Clear-ClusterNode' PowerShell cmdlet on this machine. Alternatively, you may
reset the IPSec security association timeout by deleting the '%2' value and the
'%3' value from HKEY_LOCAL_MACHINE in the Windows registry.

Event 4627: NODECLEANUP_DELETE_CLUSTER_TASKS_FAILED

Deletion of clustered tasks during node cleanup failed. The error code was '%1'.
Use Windows Task Scheduler to delete any remaining clustered tasks.

Event 4629: NODECLEANUP_DELETE_LOCAL_ACCOUNT_FAILED

During node cleanup, the local user account that is managed by the cluster was
not deleted. The error code was '%1'. Open Local Users and Groups (lusrmgr.msc)
to delete the account.

Event 4864: RES_VSSTASK_OPEN_FAILED

Volume shadow copy service task resource '%1' creation failed. The error code
was '%2'.

Event 4865: RES_VSSTASK_TERMINATE_TASK_FAILED

Volume shadow copy service task resource '%1' failed. The error code was '%2'.
This is because the associated task could not be stopped as part of an offline
operation. You may need to stop it manually using the Task Scheduler snap-in.

Event 4866: RES_VSSTASK_DELETE_TASK_FAILED

Volume shadow copy service task resource '%1' failed. The error code was '%2'.
This is because the associated task could not be deleted as part of an offline
operation. You may need to delete it manually using the Task Scheduler snap-in.

Event 4867: RES_VSSTASK_ONLINE_FAILED

Volume shadow copy service task resource '%1' failed. The error code was '%2'.
This is because the associated task could not be added as part of an online
operation. Please use the Task Scheduler snap-in to ensure your tasks are
properly configured.

Event 4868: UNABLE_TO_START_AUTOLOGGER

Cluster service failed to start the cluster log trace session. The error code
was '%2'. The cluster will function properly, but supplemental logging
information will be missing. Use the Performance Monitor snap-in to verify the
event channel settings for '%1'.

Event 4869: NETFT_WATCHDOG_PROCESS_HUNG

User mode health monitoring has detected that the system is not being
responsive. The Failover cluster virtual adapter has lost contact with the '%1'
process with a process ID '%2', for '%3' seconds. Please use Performance Monitor
to evaluate the health of the system and determine which process may be
negatively impacting the system.

Event 4870: NETFT_WATCHDOG_PROCESS_TERMINATED

User mode health monitoring has detected that the system is not being
responsive. The Failover cluster virtual adapter has lost contact with the '%1'
process with a process ID '%2', for '%3' seconds. Recovery action will be taken.

Event 4871: NETFT_MINIPORT_INITIALIZATION_FAILURE

The cluster service failed to start. This was because the failover cluster
virtual adapter failed to initialize the miniport adapter. The error code was
'%1'. Verify that other network adapters are functioning properly and check the
device manager for errors. If the configuration was changed, it may be necessary
to reinstall the failover clustering feature on this computer.

Event 4872: NETFT_MISSING_DATALINK_ADDRESS

The failover cluster virtual adapter failed to generate a unique MAC address.
Either it was unable to find a physical Ethernet adapter from which to generate
a unique address or the generated address conflicts with another adapter on this
machine. Please run the Validate a Configuration wizard to check your network
configuration.

Event 5122: DCM_EVENT_ROOT_CREATION_FAILED

Cluster service failed to create the Cluster Shared Volumes root directory '%2'.
The error message was '%1'.

Event 5142: DCM_VOLUME_NO_ACCESS

Cluster Shared Volume '%1' ('%2') is no longer accessible from this cluster node

because of error '%3'. Please troubleshoot this node's connectivity to the
storage device and network connectivity.

Event 5143: DCM_VETO_RESOURCE_MOVE_DUE_TO_CC

Move of the disk ('%2') is vetoed based on the current state of the Cache
Manager on the node '%1' to prevent a potential deadlock. 'Cache Manager Dirty
Pages Threshold' is %3, and 'Cache Manager Dirty Pages' is %4. Move is allowed if
'Cache Manager Dirty Pages' is less than 70% of 'Cache Manager Dirty Pages
Threshold' or if 'Cache Manager Dirty Pages Threshold' minus 'Cache Manager Dirty
Pages' is greater than 128000 pages (about 500MB if a page size is 4096 bytes).
Cluster vetoed resource move to prevent potential deadlock due to Cache Manager
throttling buffered writes while Cluster Shared Volumes on this disk are being
paused.

Event 5144: DCM_SNAPSHOT_DIFF_AREA_FAILURE

While adding the disk ('%1') to Cluster Shared Volumes, setting explicit
snapshot diff area association for volume ('%2') failed with error '%3'. The
only supported software snapshot diff area association for Cluster Shared
Volumes is to self.

Event 5145: DCM_SNAPSHOT_DIFF_AREA_DELETE_FAILURE

Cluster disk resource '%1' failed to delete a software snapshot. The diff area
on volume '%3' could not be dissociated from volume '%2'. This may be caused by
active snapshots. Cluster Shared Volumes requires that the software snapshot be
located on the same disk.

Event 5146: DCM_VETO_RESOURCE_MOVE_DUE_TO_DISMOUNT

Move of the Cluster Shared Volume resource '%1' is vetoed because one
of the volumes belonging to the resource is in dismounted state. Please retry
the action after the dismount operation is completed.

Event 5147: DCM_VETO_RESOURCE_MOVE_DUE_TO_SNAPSHOT

Move of the Cluster Shared Volume resource '%1' is vetoed because one of the
volumes belonging to the resource is in dismounted state. Please retry the
action after the dismount operation is completed.

Event 5148: DCM_VETO_RESOURCE_MOVE_DUE_TO_IO_MODE_CHANGE

Move of the Cluster Shared Volume resource '%1' is vetoed because an IO mode
change operation (Direct IO to Redirected IO or vice versa) is in progress on
one of the volumes belonging to the resource. Please retry the action after the
operation is completed.

Event 5150: DCM_SET_RESOURCE_IN_FAILED_STATE

Cluster physical disk resource '%1' failed. The Cluster Shared Volume was put in
failed state with the following error: '%2'

Event 5200: CAM_CANNOT_CREATE_CNO_TOKEN

Cluster service failed to create a cluster identity token for Cluster Shared
Volumes. The error code was '%1'. Ensure the domain controller is accessible and
check for connectivity issues. Until connection to the domain controller is
recovered, some operations on this node against the Cluster Shared Volumes might
fail.

Event 5216: CSV_SW_SNAPSHOT_FAILED

Software snapshot creation on Cluster Shared Volume '%1' ('%2') failed with
error %3. The resource must be online to support snapshot creation. Please check
the state of the resource.

Event 5217: CSV_SW_SNAPSHOT_SET_FAILED

Software snapshot creation on Cluster Shared Volume(s) ('%1') with snapshot set
id '%2' failed with error '%3'. Please check the state of the CSV resources and
the system events of the resource owner nodes.

Event 5219: CSV_REGISTER_SNAPSHOT_PROV_WITH_VSS_FAILED

Cluster service failed to register the Cluster Shared Volumes snapshot provider
with the Volume Shadow Service (VSS). This may be due to the VSS service
shutting down or may be a problem with the VSS service having a problem that
causes it to not accept incoming requests.

Error: %1

Event 5377: OPERATION_EXCEEDED_TIMEOUT

An internal Cluster service operation exceeded the defined threshold of '%2'
seconds. The Cluster service has been terminated to recover. Service Control
Manager will restart the Cluster service and the node will rejoin the cluster.

Event 5396: TWO_PARTITIONS_HAVE_QUORUM

The Cluster service on this node is shutting down because it has detected that
there are other cluster nodes that have quorum. This occurs when the Cluster
service detects another node that was started with the Force Quorum switch
(/fq). The node which was started with the Force Quorum Switch will remain
running. Use Failover Cluster Manager to verify that this node automatically
joined the cluster when the cluster service restarted.

Event 5397: RLUA_ACCOUNT_FAILED

The cluster resource '%1' could not create or modify the replicated local user
account '%2' on this node. Check the cluster logs for more information.

Event 5398: NM_EVENT_CLUSTER_FAILED_TO_FORM

Cluster failed to start. The latest copy of cluster configuration data was not
available within the set of nodes attempting to start the cluster. Changes to
the cluster occurred while the set of nodes were not in membership and as a
result were not able to receive configuration data updates.

Votes required to start cluster: %1  
Votes available: %2  
Nodes with votes: %3

Guidance

Attempt to start the cluster service on all nodes in the cluster so that nodes with the latest copy of the cluster configuration data can first form the cluster. The cluster will be able to start and the nodes will automatically obtain the updated cluster configuration data. If there are no nodes available with the latest copy of the cluster configuration data, run the Start-ClusterNode -FQ Windows PowerShell cmdlet. Using the ForceQuorum (FQ) parameter will start the cluster service and mark this node's copy of the cluster configuration data to be authoritative. Forcing quorum on a node with an outdated copy of the cluster database may result in cluster configuration changes that occurred while the node was not participating in the cluster to be lost.

Warning events

Event 1011: NM_NODE_EVICTED

Cluster node %1 has been evicted from the failover cluster.

Event 1045: RES_IPADDR_IPV4_ADDRESS_CREATE_FAILED

No matching network interface found for resource '%1' IP address '%2' (return
code was '%3'). If your cluster nodes span different subnets, this may be
normal.

Event 1066: RES_DISK_CORRUPT_DISK

Cluster disk resource '%1' indicates corruption for volume '%2'. Chkdsk is being
run to repair problems. The disk will be unavailable until Chkdsk completes.
Chkdsk output will be logged to file '%3'.

Chkdsk may also write information to the Application Event Log.

Event 1068: RES_SMB_SHARE_CANT_ADD

Cluster file share resource '%1' cannot be brought online. Creation of file
share '%2' (scoped to network name %3) failed due to error '%4'. This operation
will be automatically retried.

Event 1071: RCM_RESOURCE_ONLINE_BLOCKED_BY_LOCKED_MODE

The operation attempted on cluster resource '%1' of type '%3' in clustered role
'%2' could not be completed because the resource or one of its providers has
locked status.

Event 1071: RCM_RESOURCE_OFFLINE_BLOCKED_BY_LOCKED_MODE

The operation attempted on cluster resource '%1' of type '%3' in clustered role
'%2' could not be completed because the resource or one of its dependents has
locked status.

Event 1094: SM_INVALID_SECURITY_LEVEL

The cluster common property SecurityLevel cannot be changed on this cluster. The
cluster security level cannot be changed because the cluster is currently
configured for no authentication mode.

Event 1119: RES_NETNAME_DNS_REGISTRATION_MISSING

Cluster network name resource '%1' failed to register DNS name '%2' over adapter
'%4' for the following reason: '%3'

Event 1125: TM_EVENT_CLUSTER_NETINTERFACE_UNREACHABLE

Cluster network interface '%1' for cluster node '%2' on network '%3' is
unreachable by at least one other cluster node attached to the network. The
failover cluster was not able to determine the location of the failure. Run the
Validate a Configuration wizard to check your network configuration. If the
condition persists, check for hardware or software errors related to the network
adapter. Also check for failures in any other network components to which the
node is connected such as hubs, switches, or bridges.

Event 1149: RES_NETNAME_CANT_DELETE_DNS_RECORDS

The DNS Host (A) and Pointer (PTR) records associated with Cluster resource '%1'
were not removed from the resource's associated DNS server. If necessary, they
can be deleted manually. Contact your DNS administrator to assist with this
effort.

Event 1150: RES_NETNAME_DNS_PTR_RECORD_DELETE_FAILED

The removal of the DNS Pointer (PTR) record '%2' for host '%3' which is
associated with the cluster network name resource '%1' failed with error '%4'.
If necessary, the record can be deleted manually. Contact your DNS administrator
for assistance.

Event 1151: RES_NETNAME_DNS_A_RECORD_DELETE_FAILED

The removal of the DNS Host (A) record '%2' associated with the cluster network
name resource '%1' failed with error '%3'. If necessary, the record can be
deleted manually. Contact your DNS administrator for assistance.

Event 1155: RCM_EVENT_EXITED_QUEUING

The pending move for the role '%1' did not complete.

Event 1197: RES_NETNAME_DELETE_DISABLE_FAILED

Cluster network name resource '%1' failed to delete or disable its associated
computer object '%2' during resource deletion. The error code was '%3'.

Please check if the site is Read-Only. Ensure that the cluster name object has the
appropriate permissions on the '%2' object in Active Directory.

Event 1198: RES_NETNAME_DELETE_VCO_GUID_FAILED

Cluster network name resource '%1' failed to delete computer object with guid
'%2'. The error code was '%3'.

Please check if the site is Read-Only. Ensure that the cluster name object has the appropriate permissions on the '%2' object in Active Directory.

Event 1216: SERVICE_NETNAME_CHANGE_WARNING

A name change operation on the cluster core netname resource has failed.
Attempting to revert the name change operation back to the original name has
also failed. The error code was '%1'. You may not be able to remotely manage the
cluster using the cluster name until this situation has been manually corrected.

Event 1221: RES_NETNAME_RENAME_OUT_OF_SYNCH_WITH_COMPOBJ

Cluster network name resource '%1' has a name '%2' which does not match the
corresponding computer object name '%3'. It is likely that a previous name
change of the computer object has not replicated to all domain controllers in
the domain. You will be unable to rename the network name resource until the
names become consistent. If the computer object has not been recently changed,
please contact your domain administrator to rename the computer object and
thereby make it consistent. Also, ensure that replication across domain
controllers has been successfully completed.

Event 1222: RES_NETNAME_SET_PERMISSIONS_FAILED

The computer object associated with cluster network name resource '%1' could not
be updated.

The text for the associated error code is: %2

The cluster identity '%3' may lack permissions required to update the object. Please work
with your domain administrator to ensure that the cluster identity can update
computer objects in the domain.

Event 1240: RES_IPADDR_OBTAIN_LEASE_FAILED

Cluster IP address resource '%1' failed to obtain a leased IP address.

Event 1243: RES_IPADDR_RELEASE_LEASE_FAILED

Cluster IP address resource '%1' failed to release the lease for IP address
'%2'.

Event 1251: RCM_GROUP_PREEMPTED

Clustered role '%2' was taken offline. This role was preempted by the higher
priority clustered role '%1'. The cluster service will attempt to bring
clustered role '%2' online later when system resources are available.

Event 1544: SERVICE_VSS_ONABORT

The backup operation for the cluster configuration data has been canceled. The
cluster Volume Shadow Copy Service (VSS) writer received an abort request.

Event 1548: SERVICE_CONNECT_VERSION_COMPATIBLE

Node '%1' established communication with node '%2' and detected that it is
running a different, but compatible, version of the operating system. We
recommend that all nodes run the same version of the operating system. After all
nodes have been upgraded, run the Update-ClusterFunctionalLevel Windows
PowerShell cmdlet to complete upgrading the cluster.

Event 1550: SERVICE_CONNECT_NOVERCHECK

Node '%1' established a communication session with node '%2' without performing
a version compatibility check because version compatibility checking is
disabled. Disabling version compatibility checking is not supported.

Event 1551: SERVICE_FORM_NOVERCHECK

Node '%1' formed a failover cluster without performing a version compatibility
check because version compatibility checking is disabled. Disabling version
compatibility checking is not supported.

Event 1555: SERVICE_NETFT_DISABLE_AUTOCONFIG_FAILED

Attempting to use IPv4 for '%1' network adapter failed. This was due to a
failure to disable IPv4 auto-configuration and DHCP. This may be expected if the
DHCP Client service is already disabled. IPv6 will be used if enabled, otherwise
this node may not be able to participate in a failover cluster.

Event 1558: SERVICE_WITNESS_FAILOVER_ATTEMPT

The cluster service detected a problem with the witness resource. The witness
resource will be failed over to another node within the cluster in an attempt to
reestablish access to cluster configuration data.

Event 1562: RES_FSW_ALIVEFAILURE

File share witness resource '%1' failed a periodic health check on file share
'%2'. Please ensure that file share '%2' exists and is accessible by the
cluster.

Event 1576: RES_NETNAME_DNS_REGISTRATION_SECURE_ZONE_REFUSED

Cluster network name resource '%1' failed to register the name '%2' over adapter
'%4' in a secure DNS zone. This was due to an existing record with this name and
the cluster identity does not have the sufficient privileges to update that
record. The error code was '%3'. Please contact your DNS server administrator to
verify the cluster identity has permissions on DNS record '%2'.

Event 1577: RES_NETNAME_DNS_SERVER_COULD_NOT_BE_CONTACTED

Cluster network name resource '%1' failed to register the name '%2' over adapter
'%4'. The DNS server could not be contacted. The error code was '%3.' Ensure
that a DNS server is accessible from this cluster node. The DNS registration
will be retried later.

Event 1578: RES_NETNAME_DNS_TEST_FOR_DYNAMIC_UPDATE_FAILED

Cluster network name resource '%1' failed to register dynamic updates for name
'%2' over adapter '%4'. The DNS server may not be configured to accept dynamic
updates. The error code was '%3'. Please contact your DNS server administrator
to verify that the DNS server is available and configured for dynamic
updates.

Alternatively, you can disable dynamic DNS updates by unchecking the
'Register this connection's addresses in DNS' setting in the advanced TCP/IP
settings for adapter '%4' under the DNS tab.

Event 1579: RES_NETNAME_DNS_RECORD_UPDATE_FAILED

Cluster network name resource '%1' failed to update the DNS record for name '%2'
over adapter '%4'. The error code was '%3'. Ensure that a DNS server is
accessible from this cluster node and contact your DNS server administrator to
verify the cluster identity can update the DNS record '%2'.

Event 1581: CLUSSVC_UNABLE_TO_MOVE_HIVE_TO_SAFE_FILE

The restore request for the cluster configuration data failed to make a copy of
the existing cluster configuration data file (ClusDB). While attempting to
preserve the existing configuration, the restore operation was unable to create
a copy at location '%1'. This might be expected if the existing configuration
data file was corrupt. The restore operation has continued but attempts to
revert to the existing cluster configuration may not be possible.

Event 1582: CLUSSVC_UNABLE_TO_MOVE_RESTORED_HIVE_TO_CURRENT

Cluster Service failed to move the restored cluster hive at '%1' to '%2'. This
may prevent the restore operation from succeeding successfully. If the cluster
configuration was not properly restored, please retry the restore action.

Event 1583: CLUSSVC_NETFT_DISABLE_CONNECTIONSECURITY_FAILED

Cluster service failed to disable Internet Protocol security (IPsec) on the
Failover cluster virtual adapter '%1'. This could have a negative impact on
cluster communication performance. If this problem persists, please verify your
local and domain connection security policies applying to IPSec and the Windows
Firewall. Additionally, please check for events related to the Base Filtering
Engine service.

Event 1584: SHARED_VOLUME_NOT_READY_FOR_SNAPSHOT

A backup application initiated a VSS snapshot on Cluster Shared Volume '%1'
('%3') without properly preparing the volume for snapshot. This snapshot may be
invalid and the backup may not be usable for restore operations. Please contact
your backup application vendor to verify compatibility with Cluster Shared
Volumes.

Event 1589: RES_NETNAME_DNS_RETURNING_IP_THAT_IS_NOT_PROVIDER

Cluster network name resource '%1' found one or more IP addresses associated
with DNS name '%2' that are not dependent IP address resources. The additional
addresses found were '%3'. This may affect client connectivity until the network
name and its associated DNS records are consistent. Please contact your DNS
server administrator to verify the records associated with name '%2'.

Event 1604: RES_DISK_CHKDSK_SPOTFIX_NEEDED

Cluster disk resource '%1' detected corruption for volume '%2'. Spotfix Chkdsk
is required to repair problems.

Event 1605: RES_DISK_SPOTFIX_PERFORMED

Cluster disk resource '%1' completed running ChkDsk.exe /spotfix on volume '%2'.
The return code was '%4'. Output from the ChkDsk has been logged to file '%3'.

Check the application event log for additional information from ChkDsk.

Event 1671: RES_DISK_ONLINE_SET_ATTRIBUTES_COMPLETED_FAILURE

Cluster physical disk resource cannot be brought online.

Physical Disk resource name: %1  
Error Code: %2  
Time Elapsed (seconds): %3

Guidance

Run the Validate a Configuration wizard to check your storage configuration. If the error code was ERROR_CLUSTER_SHUTDOWN then the Online Pending state was canceled by an administrator. If this is a replicated volume, then this could be the result of a failure to set the disk attributes. Review the Storage Replication events for additional information.

Event 1673: CLUSTER_NODE_ENTERED_ISOLATED_STATE

Cluster node '%1' has entered the isolated state.

Event 1675: EVENT_JOINING_NODE_QUARANTINED

Cluster node '%1' has been quarantined by '%2' and cannot join the cluster. The
node will be quarantined until '%3' and then the node will automatically attempt
to re-join the cluster.

Refer to the System and Application event logs to
determine the issues on this node. When the issue is resolved, quarantine can be
manually cleared to allow the node to rejoin with the 'Start-ClusterNode
-ClearQuarantine' Windows PowerShell cmdlet.

Node Name: %1  
QuarantineType: Quarantine by %2  
Time quarantine will be automatically cleared: %3

Event 1681: CLUSTER_GROUPS_UNMONITORED_ON_NODE

Virtual machines on node '%1' have entered an unmonitored state. The virtual
machines health will be monitored again once the node returns from an isolated
state or may failover if the node does not return. The virtual machine no longer
being monitored are: %2.

Event 1689: EVENT_DISABLE_AND_STOP_OTHER_SERVICE

The cluster service detected a service which is not compatible with Failover
Clustering. The service has been disabled to avoid possible problems with the
Failover Cluster.

Service name: '%1'

Event 4625: NODECLEANUP_RESET_NLBSFLAGS_PRESERVED

Resetting the IPSec security association timeout registry value failed during
cluster node cleanup. This is because the IPSec security association timeout was
modified after this machine was configured to be a member of a cluster. For
manual cleanup, execute the 'Clear-ClusterNode' PowerShell cmdlet on this
machine. Alternatively, you may reset the IPSec security association timeout by
deleting the '%1' value and the '%2' value from HKEY_LOCAL_MACHINE in the
Windows registry.

Event 4873: NETFT_CLUSSVC_TERMINATE_BECAUSE_OF_WATCHDOG

The cluster service has detected that the failover cluster virtual adapter has
stopped. This is expected when hot replace CPU is performed on this node.
Cluster service will stop and should automatically restart after the operation
is complete. Please check for additional events associated with the service and
ensure that the cluster service has been restarted on this node.

Event 5120: DCM_VOLUME_AUTO_PAUSE_AFTER_FAILURE

Cluster Shared Volume '%1' ('%2') has entered a paused state because of '%3'.
All I/O will temporarily be queued until a path to the volume is reestablished.

Event 5123: DCM_EVENT_ROOT_RENAME_SUCCESS

Cluster Shared Volumes root directory '%1' already exists. The directory '%1'
was renamed to '%2'. Please verify that applications accessing data in this
location have been updated as necessary.

Event 5124: DCM_UNSAFE_FILTERS_FOUND

Cluster Shared Volume '%1' ('%3') has identified one or more active filter
drivers on this device stack that could interfere with CSV operations. I/O
access will be redirected to the storage device over the network through another
Cluster node. This may result in degraded performance. Please contact the filter
driver vendor to verify interoperability with Cluster Shared Volumes.

Active filter drivers found: %2

Event 5125: DCM_UNSAFE_VOLFILTER_FOUND

Cluster Shared Volume '%1' ('%3') has identified one or more active volume
drivers on this device stack that could interfere with CSV operations. I/O
access will be redirected to the storage device over the network through another
Cluster node. This may result in degraded performance. Please contact the volume
driver vendor to verify interoperability with Cluster Shared Volumes.

Active volume drivers found: %2

Event 5126: DCM_EVENT_CANNOT_DISABLE_SHORT_NAMES

Physical disk resource '%1' does not allow disabling short name generation. This
may cause application compatibility issues. Please use 'fsutil 8dot3name set 2'
to allow disabling short name generation and then offline/online the resource.

Event 5128: DCM_EVENT_CANNOT_DISABLE_SHORT_NAMES

Physical disk resource '%1' does not allow disabling short name generation. This
may cause application compatibility issues. Please use 'fsutil 8dot3name set 2'
to allow disabling short name generation and then offline/online the resource.

Event 5133: DCM_CANNOT_RESTORE_DRIVE_LETTERS

Cluster Disk '%1' has been removed and placed back in the 'Available Storage'
cluster group. During this process an attempt to restore the original drive
letter(s) has taken longer than expected, possibly due to those drive letters
being already in use.

Event 5134: DCM_CANNOT_SET_ACL_ON_ROOT

Cluster service failed to set the permissions (ACL) on the Cluster Shared
Volumes root directory '%1'. The error was '%2'.

Event 5135: DCM_CANNOT_SET_ACL_ON_VOLUME_FOLDER

Cluster service failed to set the permissions on the Cluster Shared Volume directory '%1' ('%2'). The error was '%3'.

Event 5136: DCM_CSV_INTO_REDIRECTED_MODE

Cluster Shared Volume '%1' ('%2') redirected access was turned on. Access to the
storage device will be redirected over the network from all cluster nodes that
are accessing this volume. This may result in degraded performance. Turn off
redirected access for this volume to resume normal operations.

Event 5149: DCM_CSV_BLOCK_CACHE_RESIZED

Cache size resized to '%1' based on populated memory, user setsize is too high.

Event 5156: DCM_VOLUME_AUTO_PAUSE_AFTER_SNAPSHOT_FAILURE

Cluster Shared Volume '%1' ('%2') has entered a paused state because of '%3'.
This error is encountered when the volsnap snapshots underlying the CSV volume
are deleted outside of a user request. Possible causes of the snapshots getting
deleted are lack of space in the volume for the snapshots to grow, or IO failure
while trying to update the snapshot data. All I/O will temporarily be queued
until the snapshot state is synchronized with volsnap.

Event 5157: DCM_VOLUME_AUTO_PAUSE_AFTER_FAILURE_EXPECTED

Cluster Shared Volume '%1' ('%2') has entered a paused state because of '%3'.
All I/O will temporarily be queued until a path to the volume is reestablished.
This error is usually caused by an infrastructure failure. For example, losing
connectivity to storage or the node owning the Cluster Shared Volume being
removed from active cluster membership.

Event 5394: POOL_ONLINE_WARNINGS

The Cluster service encountered some storage errors while trying to bring
storage pool online. Run cluster storage validation to troubleshoot the issue.

Event 5395: RCM_GROUP_AUTO_MOVE_STORAGE_POOL

Cluster is moving the group for storage pool '%1' because current node '%3' does
not have optimal connectivity to the storage pool physical disks.

Informational events

Event 1592: CLUSSVC_TCP_RECONNECT_CONNECTION_REESTABLISHED

Cluster node '%1' lost communication with cluster node '%2'. Network
communication was reestablished. This could be due to communication temporarily
being blocked by a firewall or connection security policy update. If the problem
persists and network communication are not reestablished, the cluster service on
one or more nodes will stop. If that happens, run the Validate a Configuration
wizard to check your network configuration. Additionally, check for hardware or
software errors related to the network adapters on this node, and check for
failures in any other network components to which the node is connected such as
hubs, switches, or bridges.

Event 1594: CLUSTER_FUNCTIONAL_LEVEL_UPGRADE_COMPLETE

Cluster service successfully upgraded the cluster functional level.

Functional Level: %1  
Upgrade Version: %2

Event 1635: RCM_RESOURCE_FAILURE_INFO_WITH_TYPENAME

Cluster resource '%1' of type '%3' in clustered role '%2' failed.

Event 1636: CLUSSVC_PASSWORD_CHANGED

The Cluster service has changed the password of account '%1' on node '%2'.

Event 1680: CLUSTER_NODE_EXITED_ISOLATED_STATE

Cluster node '%1' has exited the isolated state.

Event 1682: CLUSTER_GROUP_MOVED_NO_LONGER_UNMONITORED

Virtual machine '%2' which was unmonitored on the isolated node '%1' has been
failed over to another node. The health of the virtual machine is once again
being monitored.

Event 1682: CLUSTER_MULTIPLE_GROUPS_NO_LONGER_UNMONITORED

Node '%1' has rejoined the cluster and the following virtual machines running on
that node are once again having their health state monitored: %2.

Event 4621: NODECLEANUP_SUCCESS

This node was successfully removed from the cluster.

Event 5121: DCM_VOLUME_NO_DIRECT_IO_DUE_TO_FAILURE

Cluster Shared Volume '%1' ('%2') is no longer directly accessible from this
cluster node. I/O access will be redirected to the storage device over the
network to the node that owns the volume. If this results in degraded
performance, please troubleshoot this node's connectivity to the storage device
and I/O will resume to a healthy state once connectivity to the storage device
is reestablished.

Event 5218: CSV_OLD_SW_SNAPSHOT_DELETED

Cluster physical disk resource '%1' deleted a software snapshot. The software
snapshot on Cluster Shared Volume '%2' was deleted because it was older than
'%3' day(s). The snapshot ID was '%4' and it was created from node '%5' at '%6'.
It is expected that snapshots are deleted by a backup application after a backup
job is completed. This snapshot exceeded the time that is expected for a
snapshot to exist. Verify with the backup application that backup jobs are
completing successfully.

Reference

Detailed event info for Failover Clustering components in Windows Server 2008