-1

PowerShell Script

New-Cluster -Name "DI-XXX-YY-CLUSTER" -Node "di-XXX-YY-db1","di-XXX-YY-db2" -NoStorage  -StaticAddress 172.17.XX.YYY
Set-ClusterQuorum -NodeAndFileShareMajority "\\DI-XXX-YY-WS1\ClusterQuorum" 


Invoke-Command -ComputerName "DI-XXX-YY-WS1" -ScriptBlock { mkdir c:\Quorum}
Invoke-Command -ComputerName "DI-XXX-YY-WS1" -ScriptBlock { New-SmbShare -Name "Quorum" -Path "c:\Quorum" -FullAccess  "didevtest.local\DI-XXX-YY-CLUSTE"}

Add-ClusterNode -Cluster "DI-XXX-YY-CLUSTER" -Name "di-XXX-YY-db2" -NoStorage

The Server manager on the second node (di-XXX-YY-db2) showing a warning.

Incomplete communication with DI-XXX-YY-CLUSTER. The following nodes or cluster roles might be offline or have connectivity issues

Server Manager->All Servers enter image description here

The Server Manager refresh fails on the second node (di-XXX-YY-db2)

enter image description here

enter image description here

Windows error log entries

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server di-XXX-XX-db1$. The target name used was MSServerClusterMgmtAPI/DI-XXX-XX-CLUSTER.didevtest.local. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (DIDEVTEST.LOCAL) is different from the client domain (DIDEVTEST.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

DCOM was unable to communicate with the computer DI-XXX-XX-CLUSTER.didevtest.local using any of the configured protocols; requested by PID 14d4 (C:\Windows\system32\ServerManager.exe).

TylerH
  • 20,799
  • 66
  • 75
  • 101
user1716729
  • 387
  • 1
  • 6
  • 19

2 Answers2

1

You are creating a Windows Server Failover Cluster (WSFC), not an FCI. FCI is the clustered instance of SQL Server.

That said, check networking (including DNS), firewall, and most importantly, AD. If the WSFC is not coming online, it could be any of these things. Make sure that the CNO is precreated or the account creating the WSFC has rights to create objects in AD. If the object is there but not in DNS, similar issue - make sure DNS is right.

Also, why are you running Add-ClusterNode? The WSFC is being formed with both nodes in New-Cluster.

Check the logs and Event Viewer. They will give you a clue as to why things are messed up.

Allan Hirt
  • 11
  • 1
  • Thanks, The cluster virtual account name exists in AD. The DNS has an entry for the cluster name.I create the cluster using a domain admin account. All the cluster related ports are allowed in both servers. Funny thing is , the cluster is both nodes online – user1716729 Mar 08 '19 at 23:51
  • So you added the Kerb error. When you see that message, it's usually SPN or DNS. Check your SPNs, bad DNS stuff, make sure scavenging didn't do anything weird, etc. – Allan Hirt Mar 09 '19 at 00:21
  • could you please guide me on what to check on SPN or DNS. Sorry, I am new to clustering.. – user1716729 Mar 09 '19 at 00:25
  • It could be any number of things. The first thing I would do is run validation and see what it says. – Allan Hirt Mar 09 '19 at 00:33
  • Validated without storage,1 warning Node DI-XXX-XX-DB2.didevtest.local is reachable from Node DI-XXX-XX-DB1.didevtest.local by only one pair of network interfaces. It is possible that this network path is a single point of failure for communication within the cluster. Please verify that this single path is highly available, or consider adding additional networks to the cluster. – user1716729 Mar 09 '19 at 00:37
1

One NIC is fine if it's virtualized. There are cases where you would have two NICs (always in physical). Do you have two NICs in one server but not the other?

Also read all the text and not just go by the yellow/green/blue. Sometimes the problem is in the notes.

That said, again, go check SPNs and DNS. Look for things like duplicate or stale DNS records or duplicate SPNs.

You can search for "KRB_AP_ERR_MODIFIED cluster" on the web to see quite a few different solutions, but most are DNS related (including what I mentioned).

Allan Hirt
  • 11
  • 1