3

While validating a Failover Cluster over two member servers I get the following two errors:

  1. Connectivity to a writable domain controller from node SQL2.domain.com could not be determined because of this error: Could not get domain controller name from machine SQL2.
  2. Node(s) SQL2.domain.com cannot reach a writable domain controller. Please check connectivity of these nodes to the domain controllers.

If I run the Failover Cluster from SQL2.domain.com I get the same errors about SQL1.domain.com .

I have disabled IPv6 on the DC and SQL1/2, rebooted the servers after each attempt and removed/rejoined the member servers in the domain and nothing worked.

Both servers use only one DNS server which is the DC and the DC has public DNS servers setup in the forwarders list. This is a vanilla installation with no Firewall, DNS or LDAP changes.

From both member servers I can perform nslookup on the domain name and domain controller FQDN and it's responding for ICMP.

Paul
  • 151
  • 1
  • 1
  • 6
  • 3
    First, making random changes isn't a good approach. Re-enable IPv6 on all servers, reboot and try again. – joeqwerty Jan 24 '16 at 22:23
  • This sounds like your DNS is misconfigured. Can you please verify your domain controller's registration in DNS. https://technet.microsoft.com/en-au/library/cc738991(v=ws.10).aspx – blacklight Jan 24 '16 at 22:34
  • I've ran `dcdiag /test:dns` on the DC and it didn't report any problems and I get a valid response for nslookups for _ldap._tcp.dc._msdcs.domain.com on all member servers. – Paul Jan 24 '16 at 23:42
  • Did the nslookup for _ldap._tcp.dc._msdcs.domain.com return the actual names of your DCs? I'm interested to see if your reverse lookup zones are working. – blacklight Jan 25 '16 at 00:49
  • Reverse Lookup Zones aren't a component of AD and aren't required by AD and shouldn't be relevant to the problem. – joeqwerty Jan 25 '16 at 01:29
  • Yes I'm not even sure where I was going with that, disregard that comment. – blacklight Jan 25 '16 at 03:00

2 Answers2

3

This could be a permissions issue on your AD.

The user who is creating the cluster, or in your case running the validation wizard, must be able to create computer objects/accounts in AD. I would first check that.

When running the Failover Cluster Wizards an computer name object (CNO) is created for the cluster, if this fails, you may experience the error as shown.

You can "prestage" this account by manually creating the computer object for your cluster, with the exact name you are going to give your cluster, by creating this in the computers container. You should give it the "Create Computers objects" and "Read all Properties" permissions in the container you create the object. (which should be the computers container of the domain)

A more details step-by-step for prestaging is listed here: https://technet.microsoft.com/en-us/library/cc731002(v=ws.10).aspx#BKMK_steps_precreating

But I would start with checking the permissions of the user account which is used to create the cluster / run the validation wizard, that is a lot easier to do then to prestage.

Please let us know your progress. HTH, Edwin.

Edwin van Mierlo
  • 333
  • 1
  • 9
  • Hi Edwin, thank you for your reply. I am using the Administrator account which is part of the Domain Admins group (almost everything in the domain is vanilla except for the fact that I renamed the DC name after the system was promoted as a DC, I did check the DNS and everything is properly renamed and there are no records with the old name of the DC). I am going to try to create the CNOs manually to see if that resolves the issue. I'll keep you updated. – Paul Jan 28 '16 at 12:09
  • You renamed the DC... that could be your issue. This article says how to safely rename a DC: https://technet.microsoft.com/en-us/library/cc816601(v=ws.10).aspx – CaM Feb 06 '17 at 19:31
1

Since the day I posted this I've found out that the problem was that I was trying to create the failover cluster on a domain controller.

Paul
  • 151
  • 1
  • 1
  • 6