Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 2 down vote favorite

In Sql Server 2012, I am trying to install Failover Clustering to configure AlwaysOn Availability Groups. When I run Cluster Validation test wizard, it comes back with a lot of errors. One of them points to not having privileges to create 'Computer Object' in our Active Directory. So, I tried to gather any documentation that would help me understand what this means and I found this article on MSDN

Now, I have a question:

In the MSDN article, the paragraph right above this diagram talks about some 'Computer Account' and 'Computer Account for Clustered Service'. I re-read the paragraphs several times, but I am not sure if I can distinguish between these two. Could someone with experience on AoAG, shed some light on what this means.

MSDN Article

share|improve this question

1 Answer

up vote 2 down vote

What it means is that the computer object of the cluster (within Active Directory) will have the same set of the permissions as the user that created the cluster (and in turn, the cluster computer object).

This cluster computer object will then be the security context when a cluster service or application needs to have a computer object created.

Think of it like this: Joe creates a cluster and the cluster computer object is Cluster1. When a computer object of the cluster needs to be created, it will be under the context of Cluster1. And Cluster1 will have the permission set of Joe.

Take a look at a blog post I wrote on this very topic (SQL Salt). Maybe that will shed a little more light on this. When you create a listener, for instance, auditing AD will show that it is the cluster computer object that is actually creating the listener computer object.

In many environments this elevated security for computer objects may be undesirable. Therefore you can pre-stage these objects within AD. The end result should be the same.

share|improve this answer
Thank you for the quick response. I'll read the blog article, hopefully that will help. Following you example: Cluster1 is the Cluster name (Computer Object Name) and Joe is the account that is running the 'Create cluster' wizard. Right? So, Joe must have permissions to create a new computer object called 'Cluster1' (Computer Object Name) in the AD (domain). Then what is 'Computer Account for Cluster Service or Application'. How is this different from the 'Cluster1'. I'll add my guess in the following comment. – UB01 Feb 19 at 2:24
So, 'Cluster1' is the name of cluster (like a computer name in the domain) and 'Computer Account for Clustered Service or Application' is like a user account under which the 'Cluster1' will run. Essentially 'Cluster1' is a service on the OS (but in the Domain, it is treated as a new computer). Now we need Joe to have all the permissions because, 1) he needs to create 'Cluster1' 2) create a new user for 'Computer Account for Clustered Service or Application' and assign this account all privileges. Is this guess work correct? – UB01 Feb 19 at 2:29
Neither Joe or Cluster1 need the permission, that's where pre-staging the cluster object names within AD would come into play. – Thomas Stringer Feb 19 at 2:36
Cluster1 would be the computer name object of the cluster, and the cluster service or application computer object would be the CNO for the listener, for example. – Thomas Stringer Feb 19 at 2:42
Thanks for the response. I understand the prestaging process (or I think). Now, if we were to take the non-prestage route, are the comments I made earlier valid? Now a different follow up (based on your new comments). Cluster1 is the name of the cluster and 'DBClusterListner' (let's say) is the Cluster Service or Application. Since these both are Computer Object Names, the person who creates them needs permissions on AD (domain), correct? – UB01 Feb 19 at 16:29
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.