SQL Server 2019 Always On - Ensure that cluster name object (CNO) is granted permissions to the Secure DNS Zone

Question

I have here a SQL Server 2019 Always On with a lot of errors like this one:

2 nodes configured in a cluster with file share witness.

Cluster name: SQLCLS
Listener name: SQLLSN

Event:

Cluster network name resource failed registration of one or more associated DNS names(s) because the access to update the secure DNS Zone was denied.

Cluster Network name: 'SQLCLS_SQLLSN'
DNS Zone: 'contoso.local'

Ensure that cluster name object (CNO) is granted permissions to the Secure DNS Zone.

Answer 1

I'm assuming the title is the question...

Ensure that cluster name object (CNO) is granted permissions to the Secure DNS Zone

You'll need to check with whatever you're using for secure dns (SecureDNS, Infoblox, etc.) and either allow access using that computer account or create the DNS entries and don't give it access.

The error is just stating it can't dynamically update, which is fine if you're administratively doing so by hand. It's when you don't keep up with it that it becomes a problem.

Answer 2

You need to ensure both Cluster & Listener CNO A Record has Full access under Security tab for the Cluster in question.

i.e. Open DNS Manager >> double click on the Cluster name >> Security tab Under Security > Groups or User names >> Select SQDB$"usually the cluster name" Check "Full" under permission "SQDB01$"

Hope this helps.