Cannot join existing Cluster - Access is denied

All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..

I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
reboot the cluster service would not start.

After some troubleshooting i decided to evict node 1 from my cluster, with
the idea of re-adding it once that was completed.

Using the cluster administrator, Add Node Wizard, i assign my hostname of
node 1 and it goes through the feasibility screens with no problem. However,
when it actually tries to add the node to the cluster it fails. I am getting
access is denied errors. Speficially one error that i cannot find any info on
is:

Description
"A problem occured when the wizard attempted to verify if whether this node
can interoperate with the sponsor cluster"

Status
Access is denied

I have verified all the obvious, Cluster service account pwd, member of
local admin, user rights assignments, ect..

I am thinking that NTLMv2 is part of this problem somewhere - but not sure
where.. Before i rebooted node1, it uptime was 228 days..

I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
consistent between my Domain controller, node 1 and node 2.

I really need some assistance on this one - plesae advise..

TIA

-Drumgod

Drum on .. .. . . .

Have you tried a /forcecleanup already?

Drumgod wrote:
> All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..
>
> I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
> reboot the cluster service would not start.
>
> After some troubleshooting i decided to evict node 1 from my cluster, with
> the idea of re-adding it once that was completed.
>
> Using the cluster administrator, Add Node Wizard, i assign my hostname of
> node 1 and it goes through the feasibility screens with no problem. However,
> when it actually tries to add the node to the cluster it fails. I am getting
> access is denied errors. Speficially one error that i cannot find any info on
> is:
>
> Description
> "A problem occured when the wizard attempted to verify if whether this node
> can interoperate with the sponsor cluster"
>
> Status
> Access is denied
>
> I have verified all the obvious, Cluster service account pwd, member of
> local admin, user rights assignments, ect..
>
> I am thinking that NTLMv2 is part of this problem somewhere - but not sure
> where.. Before i rebooted node1, it uptime was 228 days..
>
> I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
> consistent between my Domain controller, node 1 and node 2.
>
> I really need some assistance on this one - plesae advise..
>
> TIA
>
> -Drumgod
>
> Drum on .. .. . . .

Yes i have done the /forceCleanUp on the cluster - obviously with no resolve.

"Dawho" wrote:

> Have you tried a /forcecleanup already?
>
> Drumgod wrote:
> > All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..
> >
> > I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
> > reboot the cluster service would not start.
> >
> > After some troubleshooting i decided to evict node 1 from my cluster, with
> > the idea of re-adding it once that was completed.
> >
> > Using the cluster administrator, Add Node Wizard, i assign my hostname of
> > node 1 and it goes through the feasibility screens with no problem. However,
> > when it actually tries to add the node to the cluster it fails. I am getting
> > access is denied errors. Speficially one error that i cannot find any info on
> > is:
> >
> > Description
> > "A problem occured when the wizard attempted to verify if whether this node
> > can interoperate with the sponsor cluster"
> >
> > Status
> > Access is denied
> >
> > I have verified all the obvious, Cluster service account pwd, member of
> > local admin, user rights assignments, ect..
> >
> > I am thinking that NTLMv2 is part of this problem somewhere - but not sure
> > where.. Before i rebooted node1, it uptime was 228 days..
> >
> > I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
> > consistent between my Domain controller, node 1 and node 2.
> >
> > I really need some assistance on this one - plesae advise..
> >
> > TIA
> >
> > -Drumgod
> >
> > Drum on .. .. . . .
>

I'm just speculating but I would either figure you might have a corrupt
quorum log or a corrupt clusdb. I'd start with the quorum but here are
some links:

http://support.microsoft.com/?id=245762

http://support.microsoft.com/?id=224999


Drumgod wrote:
> Yes i have done the /forceCleanUp on the cluster - obviously with no resolve.
>
> "Dawho" wrote:
>
>> Have you tried a /forcecleanup already?
>>
>> Drumgod wrote:
>>> All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..
>>>
>>> I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
>>> reboot the cluster service would not start.
>>>
>>> After some troubleshooting i decided to evict node 1 from my cluster, with
>>> the idea of re-adding it once that was completed.
>>>
>>> Using the cluster administrator, Add Node Wizard, i assign my hostname of
>>> node 1 and it goes through the feasibility screens with no problem. However,
>>> when it actually tries to add the node to the cluster it fails. I am getting
>>> access is denied errors. Speficially one error that i cannot find any info on
>>> is:
>>>
>>> Description
>>> "A problem occured when the wizard attempted to verify if whether this node
>>> can interoperate with the sponsor cluster"
>>>
>>> Status
>>> Access is denied
>>>
>>> I have verified all the obvious, Cluster service account pwd, member of
>>> local admin, user rights assignments, ect..
>>>
>>> I am thinking that NTLMv2 is part of this problem somewhere - but not sure
>>> where.. Before i rebooted node1, it uptime was 228 days..
>>>
>>> I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
>>> consistent between my Domain controller, node 1 and node 2.
>>>
>>> I really need some assistance on this one - plesae advise..
>>>
>>> TIA
>>>
>>> -Drumgod
>>>
>>> Drum on .. .. . . .

Check into the two URLs. No change.

Just to note - i have node 2 up and running. It is currently hosting my
cluster. So i dont think the quorum is corrupt.

Our network is a government network and we are strictly governed by security
settings of the DISA GOLD DISK and RETINA. And since these cluster servers
have not been rebooted in 228 day (until just recently) im sure its one of
the security changes required by either of thoses software package - i just
dont have a clue as to which one..

"Dawho" wrote:

> I'm just speculating but I would either figure you might have a corrupt
> quorum log or a corrupt clusdb. I'd start with the quorum but here are
> some links:
>
> http://support.microsoft.com/?id=245762
>
> http://support.microsoft.com/?id=224999
>
>
> Drumgod wrote:
> > Yes i have done the /forceCleanUp on the cluster - obviously with no resolve.
> >
> > "Dawho" wrote:
> >
> >> Have you tried a /forcecleanup already?
> >>
> >> Drumgod wrote:
> >>> All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..
> >>>
> >>> I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
> >>> reboot the cluster service would not start.
> >>>
> >>> After some troubleshooting i decided to evict node 1 from my cluster, with
> >>> the idea of re-adding it once that was completed.
> >>>
> >>> Using the cluster administrator, Add Node Wizard, i assign my hostname of
> >>> node 1 and it goes through the feasibility screens with no problem. However,
> >>> when it actually tries to add the node to the cluster it fails. I am getting
> >>> access is denied errors. Speficially one error that i cannot find any info on
> >>> is:
> >>>
> >>> Description
> >>> "A problem occured when the wizard attempted to verify if whether this node
> >>> can interoperate with the sponsor cluster"
> >>>
> >>> Status
> >>> Access is denied
> >>>
> >>> I have verified all the obvious, Cluster service account pwd, member of
> >>> local admin, user rights assignments, ect..
> >>>
> >>> I am thinking that NTLMv2 is part of this problem somewhere - but not sure
> >>> where.. Before i rebooted node1, it uptime was 228 days..
> >>>
> >>> I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
> >>> consistent between my Domain controller, node 1 and node 2.
> >>>
> >>> I really need some assistance on this one - plesae advise..
> >>>
> >>> TIA
> >>>
> >>> -Drumgod
> >>>
> >>> Drum on .. .. . . .
>

I have just discovered another sympton. On node 2 (the only working cluster
node) i can access the cluster administration GUI no problem.

On node1, and one of my W2K3 Domain Controllers, i can open the cluster
administration GUI - but once i try to establish a connection to my cluster i
get:

An error occured attempting to open cluster node 'MYCLUSTERNAME'
Access is denied
Error ID: 5(00000005)

"Drumgod" wrote:

> Check into the two URLs. No change.
>
> Just to note - i have node 2 up and running. It is currently hosting my
> cluster. So i dont think the quorum is corrupt.
>
> Our network is a government network and we are strictly governed by security
> settings of the DISA GOLD DISK and RETINA. And since these cluster servers
> have not been rebooted in 228 day (until just recently) im sure its one of
> the security changes required by either of thoses software package - i just
> dont have a clue as to which one..
>
> "Dawho" wrote:
>
> > I'm just speculating but I would either figure you might have a corrupt
> > quorum log or a corrupt clusdb. I'd start with the quorum but here are
> > some links:
> >
> > http://support.microsoft.com/?id=245762
> >
> > http://support.microsoft.com/?id=224999
> >
> >
> > Drumgod wrote:
> > > Yes i have done the /forceCleanUp on the cluster - obviously with no resolve.
> > >
> > > "Dawho" wrote:
> > >
> > >> Have you tried a /forcecleanup already?
> > >>
> > >> Drumgod wrote:
> > >>> All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..
> > >>>
> > >>> I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
> > >>> reboot the cluster service would not start.
> > >>>
> > >>> After some troubleshooting i decided to evict node 1 from my cluster, with
> > >>> the idea of re-adding it once that was completed.
> > >>>
> > >>> Using the cluster administrator, Add Node Wizard, i assign my hostname of
> > >>> node 1 and it goes through the feasibility screens with no problem. However,
> > >>> when it actually tries to add the node to the cluster it fails. I am getting
> > >>> access is denied errors. Speficially one error that i cannot find any info on
> > >>> is:
> > >>>
> > >>> Description
> > >>> "A problem occured when the wizard attempted to verify if whether this node
> > >>> can interoperate with the sponsor cluster"
> > >>>
> > >>> Status
> > >>> Access is denied
> > >>>
> > >>> I have verified all the obvious, Cluster service account pwd, member of
> > >>> local admin, user rights assignments, ect..
> > >>>
> > >>> I am thinking that NTLMv2 is part of this problem somewhere - but not sure
> > >>> where.. Before i rebooted node1, it uptime was 228 days..
> > >>>
> > >>> I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
> > >>> consistent between my Domain controller, node 1 and node 2.
> > >>>
> > >>> I really need some assistance on this one - plesae advise..
> > >>>
> > >>> TIA
> > >>>
> > >>> -Drumgod
> > >>>
> > >>> Drum on .. .. . . .
> >

Very odd...In my domains I can see any cluster from any management
console. Is the domain membership somehow skewed? Is this a DC, how does
the DCDIAG look?

Drumgod wrote:
> I have just discovered another sympton. On node 2 (the only working cluster
> node) i can access the cluster administration GUI no problem.
>
> On node1, and one of my W2K3 Domain Controllers, i can open the cluster
> administration GUI - but once i try to establish a connection to my cluster i
> get:
>
> An error occured attempting to open cluster node 'MYCLUSTERNAME'
> Access is denied
> Error ID: 5(00000005)
>
> "Drumgod" wrote:
>
>> Check into the two URLs. No change.
>>
>> Just to note - i have node 2 up and running. It is currently hosting my
>> cluster. So i dont think the quorum is corrupt.
>>
>> Our network is a government network and we are strictly governed by security
>> settings of the DISA GOLD DISK and RETINA. And since these cluster servers
>> have not been rebooted in 228 day (until just recently) im sure its one of
>> the security changes required by either of thoses software package - i just
>> dont have a clue as to which one..
>>
>> "Dawho" wrote:
>>
>>> I'm just speculating but I would either figure you might have a corrupt
>>> quorum log or a corrupt clusdb. I'd start with the quorum but here are
>>> some links:
>>>
>>> http://support.microsoft.com/?id=245762
>>>
>>> http://support.microsoft.com/?id=224999
>>>
>>>
>>> Drumgod wrote:
>>>> Yes i have done the /forceCleanUp on the cluster - obviously with no resolve.
>>>>
>>>> "Dawho" wrote:
>>>>
>>>>> Have you tried a /forcecleanup already?
>>>>>
>>>>> Drumgod wrote:
>>>>>> All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..
>>>>>>
>>>>>> I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
>>>>>> reboot the cluster service would not start.
>>>>>>
>>>>>> After some troubleshooting i decided to evict node 1 from my cluster, with
>>>>>> the idea of re-adding it once that was completed.
>>>>>>
>>>>>> Using the cluster administrator, Add Node Wizard, i assign my hostname of
>>>>>> node 1 and it goes through the feasibility screens with no problem. However,
>>>>>> when it actually tries to add the node to the cluster it fails. I am getting
>>>>>> access is denied errors. Speficially one error that i cannot find any info on
>>>>>> is:
>>>>>>
>>>>>> Description
>>>>>> "A problem occured when the wizard attempted to verify if whether this node
>>>>>> can interoperate with the sponsor cluster"
>>>>>>
>>>>>> Status
>>>>>> Access is denied
>>>>>>
>>>>>> I have verified all the obvious, Cluster service account pwd, member of
>>>>>> local admin, user rights assignments, ect..
>>>>>>
>>>>>> I am thinking that NTLMv2 is part of this problem somewhere - but not sure
>>>>>> where.. Before i rebooted node1, it uptime was 228 days..
>>>>>>
>>>>>> I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
>>>>>> consistent between my Domain controller, node 1 and node 2.
>>>>>>
>>>>>> I really need some assistance on this one - plesae advise..
>>>>>>
>>>>>> TIA
>>>>>>
>>>>>> -Drumgod
>>>>>>
>>>>>> Drum on .. .. . . .

Very odd...In my domains I can see any cluster from any management
console. Is the domain membership somehow skewed? Is this a DC, how does
the DCDIAG look?

Drumgod wrote:
> I have just discovered another sympton. On node 2 (the only working cluster
> node) i can access the cluster administration GUI no problem.
>
> On node1, and one of my W2K3 Domain Controllers, i can open the cluster
> administration GUI - but once i try to establish a connection to my cluster i
> get:
>
> An error occured attempting to open cluster node 'MYCLUSTERNAME'
> Access is denied
> Error ID: 5(00000005)
>
> "Drumgod" wrote:
>
>> Check into the two URLs. No change.
>>
>> Just to note - i have node 2 up and running. It is currently hosting my
>> cluster. So i dont think the quorum is corrupt.
>>
>> Our network is a government network and we are strictly governed by security
>> settings of the DISA GOLD DISK and RETINA. And since these cluster servers
>> have not been rebooted in 228 day (until just recently) im sure its one of
>> the security changes required by either of thoses software package - i just
>> dont have a clue as to which one..
>>
>> "Dawho" wrote:
>>
>>> I'm just speculating but I would either figure you might have a corrupt
>>> quorum log or a corrupt clusdb. I'd start with the quorum but here are
>>> some links:
>>>
>>> http://support.microsoft.com/?id=245762
>>>
>>> http://support.microsoft.com/?id=224999
>>>
>>>
>>> Drumgod wrote:
>>>> Yes i have done the /forceCleanUp on the cluster - obviously with no resolve.
>>>>
>>>> "Dawho" wrote:
>>>>
>>>>> Have you tried a /forcecleanup already?
>>>>>
>>>>> Drumgod wrote:
>>>>>> All, Having a problem joining an existing 2 node cluster. Windows 2K3 SP2..
>>>>>>
>>>>>> I recently had a problem and had to reboot node 1 of my 2 node cluster. Upon
>>>>>> reboot the cluster service would not start.
>>>>>>
>>>>>> After some troubleshooting i decided to evict node 1 from my cluster, with
>>>>>> the idea of re-adding it once that was completed.
>>>>>>
>>>>>> Using the cluster administrator, Add Node Wizard, i assign my hostname of
>>>>>> node 1 and it goes through the feasibility screens with no problem. However,
>>>>>> when it actually tries to add the node to the cluster it fails. I am getting
>>>>>> access is denied errors. Speficially one error that i cannot find any info on
>>>>>> is:
>>>>>>
>>>>>> Description
>>>>>> "A problem occured when the wizard attempted to verify if whether this node
>>>>>> can interoperate with the sponsor cluster"
>>>>>>
>>>>>> Status
>>>>>> Access is denied
>>>>>>
>>>>>> I have verified all the obvious, Cluster service account pwd, member of
>>>>>> local admin, user rights assignments, ect..
>>>>>>
>>>>>> I am thinking that NTLMv2 is part of this problem somewhere - but not sure
>>>>>> where.. Before i rebooted node1, it uptime was 228 days..
>>>>>>
>>>>>> I have verified that all my NTLMv2 req., NTLM SSP (clients,servers) are
>>>>>> consistent between my Domain controller, node 1 and node 2.
>>>>>>
>>>>>> I really need some assistance on this one - plesae advise..
>>>>>>
>>>>>> TIA
>>>>>>
>>>>>> -Drumgod
>>>>>>
>>>>>> Drum on .. .. . . .

You've obviously got some additional security complexities here, being in a
government situation. I'd really recommend triple-checking all the accounts
and permissions and try troubleshooting / re-producing this in your Test
environment.

--
Ryan Sokolowski
MVP - Clustering
MCT, MCITP x3, MCTS x8, MCSE x2, CCNA, CCDA, BCFP


"Dawho" <> wrote in message
news:...
> Very odd...In my domains I can see any cluster from any management
> console. Is the domain membership somehow skewed? Is this a DC, how does
> the DCDIAG look?
>
> Drumgod wrote:
>> I have just discovered another sympton. On node 2 (the only working
>> cluster node) i can access the cluster administration GUI no problem.
>>
>> On node1, and one of my W2K3 Domain Controllers, i can open the cluster
>> administration GUI - but once i try to establish a connection to my
>> cluster i get:
>>
>> An error occured attempting to open cluster node 'MYCLUSTERNAME'
>> Access is denied
>> Error ID: 5(00000005)
>>
>> "Drumgod" wrote:
>>
>>> Check into the two URLs. No change.
>>>
>>> Just to note - i have node 2 up and running. It is currently hosting my
>>> cluster. So i dont think the quorum is corrupt.
>>> Our network is a government network and we are strictly governed by
>>> security settings of the DISA GOLD DISK and RETINA. And since these
>>> cluster servers have not been rebooted in 228 day (until just recently)
>>> im sure its one of the security changes required by either of thoses
>>> software package - i just dont have a clue as to which one..
>>>
>>> "Dawho" wrote:
>>>
>>>> I'm just speculating but I would either figure you might have a corrupt
>>>> quorum log or a corrupt clusdb. I'd start with the quorum but here are
>>>> some links:
>>>>
>>>> http://support.microsoft.com/?id=245762
>>>>
>>>> http://support.microsoft.com/?id=224999
>>>>
>>>>
>>>> Drumgod wrote:
>>>>> Yes i have done the /forceCleanUp on the cluster - obviously with no
>>>>> resolve.
>>>>>
>>>>> "Dawho" wrote:
>>>>>
>>>>>> Have you tried a /forcecleanup already?
>>>>>>
>>>>>> Drumgod wrote:
>>>>>>> All, Having a problem joining an existing 2 node cluster. Windows
>>>>>>> 2K3 SP2..
>>>>>>>
>>>>>>> I recently had a problem and had to reboot node 1 of my 2 node
>>>>>>> cluster. Upon reboot the cluster service would not start.
>>>>>>> After some troubleshooting i decided to evict node 1 from my
>>>>>>> cluster, with the idea of re-adding it once that was completed.
>>>>>>> Using the cluster administrator, Add Node Wizard, i assign my
>>>>>>> hostname of node 1 and it goes through the feasibility screens with
>>>>>>> no problem. However, when it actually tries to add the node to the
>>>>>>> cluster it fails. I am getting access is denied errors. Speficially
>>>>>>> one error that i cannot find any info on is:
>>>>>>>
>>>>>>> Description
>>>>>>> "A problem occured when the wizard attempted to verify if whether
>>>>>>> this node can interoperate with the sponsor cluster"
>>>>>>> Status
>>>>>>> Access is denied
>>>>>>>
>>>>>>> I have verified all the obvious, Cluster service account pwd, member
>>>>>>> of local admin, user rights assignments, ect..
>>>>>>>
>>>>>>> I am thinking that NTLMv2 is part of this problem somewhere - but
>>>>>>> not sure where.. Before i rebooted node1, it uptime was 228 days..
>>>>>>>
>>>>>>> I have verified that all my NTLMv2 req., NTLM SSP (clients,servers)
>>>>>>> are consistent between my Domain controller, node 1 and node 2.
>>>>>>>
>>>>>>> I really need some assistance on this one - plesae advise..
>>>>>>>
>>>>>>> TIA
>>>>>>>
>>>>>>> -Drumgod
>>>>>>>
>>>>>>> Drum on .. .. . . .

I agree with Ryan, I think this is possibly an issue with your cluster
service account. I would guess that if you re-start the cluster service on
your currently working node, it would then also fail to restart. Any changes
to the cluster service account won't take affect in the cluster until the
cluster service is restarted.

I'd recommend reviewing the following KB and ensure that the permissions and
user rights are assigned properly to your cluster service account:

http://support.microsoft.com/kb/269229

Regards,
John

Visit my blog: http://msmvps.com/blogs/jtoner

"Ryan Sokolowski [MVP]" <> wrote in message
news:87D807EC-05CB-4BCF-891D-...
> You've obviously got some additional security complexities here, being in
a
> government situation. I'd really recommend triple-checking all the
accounts
> and permissions and try troubleshooting / re-producing this in your Test
> environment.
>
> --
> Ryan Sokolowski
> MVP - Clustering
> MCT, MCITP x3, MCTS x8, MCSE x2, CCNA, CCDA, BCFP
>
>