Article ID: 269229 - View products that this article applies to.
This article was previously published under Q269229
During the installation process for the Microsoft Cluster service, the specified domain account is granted rights that are necessary for the Cluster service to function correctly. If you ever have to change or re-create the account, you must manually grant these rights back to the domain account that is used to start the Cluster service, on each node of the cluster. Additionally, make sure that security policies do not remove rights or permissions from the Cluster service account. If rights or permissions are removed from the Cluster service account, the Cluster service may no longer function.
The account that is used to start the Cluster service must be a minimum of a domain-level USER account, and it must be added to the local administrative group on each node in the cluster. Add the account to the Local Administrators group on each node in the cluster by using either the User Manager tool in Microsoft Windows NT 4.0, or Computer Management in Microsoft Windows 2000 Server or in Microsoft Windows Server 2003.
Note Many of the rights that are mentioned in this section are assigned "by proxy." The Cluster service account must be a member of the local administrator group on the node. Therefore, if the local administrators group has a specific right, typically you do not have to add the Cluster service account. However, if you are having difficulties with the rights for the Cluster service account, you can explicitly grant all the rights directly to the account that starts the Cluster service. In Windows Server 2003, you must explicitly assign the Cluster service account to the local Administrators group of each node. For more information about a related topic, click the following article number to view the article in the Microsoft Knowledge Base:
812877Make sure that the following user rights are granted to either the local Administrator group or the domain level Cluster service account.
(http://support.microsoft.com/kb/812877/ )Cluster service does not start after you upgrade to Windows Server 2003, Enterprise Edition
Windows Server 2003Note If you change the account that is used to start the Cluster service, you must use Computer Management for Windows Server 2003 to change the account information on each node in the cluster. To do this, follow these steps:
Local Security Policy\Security Settings\Local Policies\User Rights AssignmentNote If you create a Group Policy setting to update the Impersonate a client after authentication rights policy setting, make sure that the Cluster service account is listed in the policy setting in addition to the Local Administrators group and the account that is called SERVICE. If the Cluster service account is not listed, the computer may no longer have access to Windows Management Instrumentation (WMI). By default, these accounts are listed in the Impersonate a client after authentication rights policy. However, if you create a Group Policy setting without adding the Cluster service account, the local policy setting is overwritten, and WMI access fails.
Windows 2000 ServerNote If you change the account that is used to start the Cluster service, follow these steps:
Local Security Policy\Security Settings\Local Policies\User Rights Assignment
Windows NT 4.0To configure the user rights on a Windows NT 4.0 cluster node, click User Manager, click Policies, click User Rights. Make sure that you click Show Advanced User Rights.
The Cluster service account requires the following rights on all nodes in the cluster to function correctly:
Additional things to considerWhen you remove a required right from the Cluster service account, you may cause unexpected behavior. The Cluster service may not start, or the service may not create certain clustered resources or bring these resources online. For example, if the Cluster service or the local administrator group does not have a particular user right, the Manage auditing and security log user rights assignment cannot create a Microsoft Distributed Transaction Coordinator (MSDTC) resource because the Cluster service cannot create the required crypto checkpoint settings.
Another example of this problem may occur when you modify the Access this computer from the network user right. You can modify this user right in the following location:
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights AssignmentBy default, the Everyone and Administrator groups are both assigned this right. However, if you remove this right from these groups, and you do not specifically add the Cluster service account, you may not be able to join nodes to an existing cluster. Additionally, you may receive an "Access Denied" error when you try to access the cluster by using Cluster Administrator (Cluadmin.exe).
If an organization implements Group Policy objects that override the local security policies and that remove a user right from the Cluster service by changing the effective user rights, the Cluster service will fail at some point. To resolve this problem, follow these steps:
307532Additionally, make sure that the Cluster service has the following user rights for computer objects in the appropriate OU:
(http://support.microsoft.com/kb/307532/ )How to troubleshoot the Cluster service account when it modifies computer objects
Article ID: 269229 - Last Review: October 26, 2007 - Revision: 8.4