AD CS Certificate WebEnrollment in Failover Cluster Environment - W2K8 R2

Hello,
I have my PKI in FO Cluster and everything works well except of Web Enrollment,
when I'm opening my webbrowser and typing https://cahostname/certsrv - webpage is opening but when I want to request any certificate then I receive an error - no certificate templates are available or you don't have rights to request - something like that.
I've read somewhere that certdat.inc under c$\Windows\System32\CertSrv must be modified,
I've tried many possibilities, even if certutil -ping is working, I'm still receiving that error. Ofc IIS server s restarted everytime after I change the file.
Any ideas or advices are appreciated.

If CAWE is installed on a different computer or is referenced by a virtual name then you need to have a SPN. Try this, determine which node in the cluster is running the CAWE resource at the moment, and open your web browser to http://specificnode/certsrv
rather than using the cluster virtual name. See if that makes a difference.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years. Connect with Mark at http://www.pkisolutions.com

Similar Messages

Failover cluster node - You do not have administrative privileges on the server 'servername' ?

Hi Hello & Good morning Technet's,
I would like to post a question which i really expecting a solution.
I got 2 domain in one single forest.
Domain 1: hg.corp
Domain 2: iac.corp (iac.corp
is a tree domain under hg.corp forest)
Trust : Transitive
trust between hg.corp and iac.corp
Domain controller 1: dc.hg.corp
(for hg.corp)
Domain controller 2: iacdc.iac.corp
(for iac.corp)
I want to make a Fail-over cluster between this 2 domain controllers ( But both are in different domain literally, but in same forest )
Process Validate cluster in dc.hg.corp
dc.hg.corp can added, but iacdc.iac.corp failed (Error: You do not have administrative privilages on the
server 'iacdc')
Process Validate cluster in iacdc.iac.corp
iacdc.iac.corp can added, but dc.hg.corp failed (Error: You do not have administrative privilages on the
server 'dc.hg.corp')
Technet please provide me a solution for this issue, So i can reduce server box counts.
Thank you & Have a nice day.
Shamil Mohamed

Hi,
We do not support combining the AD DS role and the failover cluster feature in Windows Server 2012.
This behavior is by design.
The related KB:
You cannot add a domain controller as a node in a Windows Server 2012 failover cluster environment
http://support.microsoft.com/kb/2795523
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Failover cluster installation

Hello,
I would like to install SAP ECC6 EhP4 from System Copy (backup/restore) in Windows failover cluster environnement with two nodes.
So, I have installed MSSQL Server 2008R2 SP2 in cluster mode (using virtual host : FRSERVERSQL).
Now, I have to install SAP ECC. (A virtual host has been created : FRSERVERSAP)
I have created manually SAP SID service on "Failover cluster manager" windows menu.
Inside this service, I have created :
- IP resource
- Shared folder (sapmnt : E:\usr\sap)
- Disque resource (E:)
I have created saploc shared folder (c:\usr\sap)
Following install guide and some SCN threads, I have doubt with the way to install SAP in Windows failover cluster environnement.
I found this way on SCN :
1. Central services instance for ABAP installation.
Use the command line sapinst.exe SAPINST_USE_HOSTNAME=FRSERVERSAP
Note - during the installation time all the cluster resource should be in Node 1
2 First MSCS node installation => on Node I? Do I need to use SAPINST_USE_HOSTNAME=FRSERVERSAP ???
3 Database Instance Installation => Do I need to use SAPINST_USE_HOSTNAME? If yes, do I use FRSERVERSQL???
4 Additional or Second MSCS node installation => on Node II? with SAPINST_USE_HOSTNAME?
5 Enqueue replication server installation for ABAP in Node I
6 Enqueue replication server installation for ABAP in Node II
7 Central Instance Installation in Node I
8 Dialog Instance Installation in Node II
9 Post processing steps after system copy
One more question.
After installation is OK, If I have to refreh this environnement (with homogenous sytem copy - backup/restore),
which option should I have to use after restore? Only Database instance installation or all options described above?
Thanks for your help
Regards

Hi Durecu
I will follow the steps mentioned but my question is about options to user with sapinst.exe?
When should I have to usr SAPINST_USE_HOSTNAME?
1. Central services instance for ABAP installation.
Use the command line sapinst.exe SAPINST_USE_HOSTNAME=FRSERVERSAP
Note - during the installation time all the cluster resource should be in Node 1
During the time of Central service instance for ABAP & JAVA you have to use the Virtual hosts (that is on MSCS SAP Group DNS name, & Cluster disk before that you have to create in MSCS)
Syntax " SAPINST.EXE SAPINST_USE_HOSTNAME=<*Virtual Host Name*> "
2 First MSCS node installation => on Node I? Do I need to use SAPINST_USE_HOSTNAME=FRSERVERSAP ???
Normal SAPINST.exe Without virtual name
3 Database Instance Installation => Do I need to use SAPINST_USE_HOSTNAME? If yes, do I use FRSERVERSQL???
Normal SAPINST.exe Without virtual name
4 Additional or Second MSCS node installation => on Node II? with SAPINST_USE_HOSTNAME?
Normal SAPINST.exe Without virtual name
Regards
Sriram

Packets sent out the wrong Interface on Hyper-V 2012 Failover Cluster

Here is some background information:
2 Dell PowerEdge servers running Windows Server 2012 w/ Hyper-V in a Failover Cluster environment. Each has:
1 NIC for Live Migration 192.168.80.x/24 (connected to a private switch)
1 NIC for Cluster Communication 192.168.90.x/24 (connected to a private switch)
1 NIC for iscsi 192.168.100.x/24 (connected to a private switch)
1 NIC for host management with a routable public IP (*connected to corp network) w/ gateway on this interface
1 NIC for Virtual Machine traffic (*connected to corp network)
All NICs are up, we can ping the IPs between servers on the private network and on the public facing networks. All functions of hyper-v are working and the failover cluster reports all interfaces are up and we receive no errors. Live migration
works fine. In the live migration settings i have restricted the use of the 2 NICs (live migration or cluster comm).
My problem is that our networking/security group sees on occasion (about every 10 minutes with a few other packets thrown in at different times) syn packets that are destined for the 192.168.80.3 interface goes out of the public interface and is dropped
at our border router. These should be heading out of the 192.168.80.x or 192.168.90.x interfaces without ever hitting our corporate network. Anyone have an idea of why this might be happening? Traffic is on TCP 445.
Appreciate the help.
Nate

Hi,
Please check live migration and Cluster Communication network settings in cluster:
In the Failover Cluster Manager snap-in, if the cluster that you want to configure is not displayed, in the console tree, right-click Failover Cluster Manager, click Manage a Cluster, and then select or specify the cluster that you want.
If the console tree is collapsed, expand the tree under the cluster that you want to configure.
Expand Networks.
Right-click the network that you want to modify settings for, and then click Properties.
There are two options:
Allow cluster network communication on this network-- Allow clients to connect through this network
Do not allow cluster network communication on this network
If the network is used only for cluster node communication, clear “Allow clients to connect through this network” option.
Check that and give us feedback for further troubleshooting, for more information please refer to following MS articles:
Modify Network Settings for a Failover Cluster
http://technet.microsoft.com/en-us/library/cc725775.aspx
Lawrence
TechNet Community Support

Question about updating SQL Server on failover cluster

Hi all,
I would like to better understand the update process of SQL Server (2008 r2) in a failover cluster environment.
In our cluster we have 4 instances of SQL running, where two of them I am able to at anytime stop the instance and update it.
The question is... Applying the latest update, will update forcibly all instances installed on that node, or do I have the ability to choose which instance I want to update?
This way, I could "test" the update process in those two SQL Instances, as described in http://support.microsoft.com/kb/958734 and after finishing I would update the remaining instances.
Please let me know.
Thanks in advance.
Nuno Silva

Hi Nuno,
It's a failover cluster issue, I moved it to SQL Server High Availability and Disaster Recovery. So that you can get better help.
Regards,
Charlie Liao
TechNet Community Support

Heartbeat Network inside Hyper-V Failover Cluster

Dear All,
I need to build an SQL Server 2012 SP1 Two-node cluster inside Hyper-V Failover Cluster. There is only one virtual switch in the Hyper-V Failover Cluster environment which is being
used for communication to the outside world using VLAN Tagging. Now, since SQL Server 2012 Failover Cluster would require a heartbeat network as well and although possible to assign VLAN tag to the heartbeat adapter and use that for hearbeat, but since there
would not be any gateway on the heartbeat network, it would render the VLAN tagging useless, so is following plan good enough:
1. Create an Internal Virtual Switch on all nodes of the cluster with the same name
2. Link the heartbeat adapter of the virtual machines to the Internal Virtual Switch
Is it good enough? or is there any other better way?
Thanks in advance.

I am not an expert on this, but here is what I would do.
Create the VLAN and use that to keep the network setup as easy to understand as possible. Our Hyper-V cluster is only using IPv6 on the heartbeat network, and that is working like a charm. I would do the same inside the hyper-v hosts if I need to builld
a virtual cluster.
What is the reason for deploying a failover cluster for SQL inside Hyper-V? Wouldn't a log shipping "cluster" provide a more secure solution for your SQL?
/Martin
Exchange is a passion not just a collaboration software.

AD CS in failover cluster

Hello!
I want to deploy AD CS in a failover cluster based on Windows Server 2012 R2.
All actions are performed following this manual -
http://technet.microsoft.com/en-us/library/cc742450(v=ws.10).aspx
On both nodes successfully installed AD CS roles and Failover clustering features.
The problem is that in mmc Failover Cluster Management in Generic Service I can't find Active Directory Certificate Services.
How can I install AD CS in Windows Server 2012 R2 failover cluster?
Thank's!

Hi iNikolay,
Please more information about your environment, such as did you have DS role on this server, since server 2012 the DC doesn’t support as cluster node, shared storage is always
a requirement for Failover Clustering.
More information:
Failover Clustering and Active Directory Certificate Services
http://gallery.technet.microsoft.com/Failover-Clustering-and-b3ea8858
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Reporting Services as a generic service in a failover cluster group?

There is some confusion on whether or not Microsoft will support a Reporting Services deployment on a failover cluster using scale-out, and adding the Reporting Services service as a generic service in a cluster group to achieve active-passive high
availability.
A deployment like this is described by Lukasz Pawlowski (Program Manager on the Reporting Services team) in this blog article
http://blogs.msdn.com/b/lukaszp/archive/2009/10/28/high-availability-frequently-asked-questions-about-failover-clustering-and-reporting-services.aspx. There it is stated that it can be done, and what needs to be considered when doing such a deployment.
This article (http://technet.microsoft.com/en-us/library/bb630402.aspx) on the other hand states: "Failover clustering is supported only for the report server database; you
cannot run the Report Server service as part of a failover cluster."
This is somewhat confusing to me. Can I expect to receive support from Microsoft for a setup like this?
Best Regards,
Peter Wretmo

Hi Peter,
Thanks for your posting.
As Lukasz said in the
blog, failover clustering with SSRS is possible. However, during the failover there is some time during which users will receive errors when accessing SSRS since the network names will resolve to a computer where the SSRS service is in the process of starting.
Besides, there are several considerations and manual steps involved on your part before configuring the failover clustering with SSRS service:
Impact on other applications that share the SQL Server. One common idea is to put SSRS in the same cluster group as SQL Server. If SQL Server is hosting multiple application databases, other than just the SSRS databases, a failure in SSRS may cause
a significant failover impact to the entire environment.
SSRS fails over independently of SQL Server.
If SSRS is running, it is going to do work on behalf of the overall deployment so it will be Active. To make SSRS Passive is to stop the SSRS service on all passive cluster nodes.
So, SSRS is designed to achieve High Availability through the Scale-Out deployment. Though a failover clustered SSRS deployment is achievable, it is not the best option for achieving High Availability with Reporting Services.
Regards,
Mike Yin
If you have any feedback on our support, please click
here
Mike Yin
TechNet Community Support

The Cluster Service function call 'ClusterResourceControl' failed with error code '1008(An attempt was made to reference a token that does not exist.)' while verifying the file path. Verify that your failover cluster is configured properly.

I am experiencing this error with one of our cluster environment. Can anyone help me in this issue.
The Cluster Service function call 'ClusterResourceControl' failed with error code '1008(An attempt was made to reference a token that does not exist.)' while verifying the file path. Verify that your failover cluster is configured properly.
Thanks,
Venu S.
Venugopal S ----------------------------------------------------------- Please click the Mark as Answer button if a post solves your problem!

Hi Venu S,
Based on my research, you might encounter a known issue, please try the hotfix in this KB:
http://support.microsoft.com/kb/928385
Meanwhile since there is less information about this issue, before further investigation, please provide us the following information:
The version of Windows Server you are using
The result of SELECT @@VERSION
The scenario when you get this error
If anything is unclear, please let me know.
Regards,
Tom Li

Failover Cluster Network Name Failed and Can't be Repaired

I have an issue that seem to be a different problem than any others have encountered.
I've scoured everything I can find and nothing has fixed my problem.
The problem starts with the common problem of the cluster network name failing on my 2 node server 2012 file server cluster. The computer object was still in AD and appeared to be fine so it was not the common problem of the object
getting deleted somehow. At the time, there was no other object with that name in the recycling bin, so I don't think it was mistakenly deleted and quickly recreated to cover any tracks, so to speak.
Following one guide, I tried to find the registry key that corresponded with the GUID of the object, but neither node in the cluster had it in its registry (which may be part of the problem).
Since it was in the failed state, I tried to do the repair on the object to no avail.
We run a "locked down" DC environment so all computer objects have to be pre-provisioned. They were all pre-provisioned successfully and successfully assigned during cluster creation. The cluster was running with no issues for a month
or so before this problem came up.
When I do a repair on the object while taking diagnostic logs the following 4609 error appears:
The action 'Repair' did not complete. - System.ApplicationException: An error occurred resetting the password for 'Cluster Name'. ---> System.ComponentModel.Win32Exception: Unknown error (0x80005000)
There appears to be a corresponding 4771 error with a failure code 0x18 that comes from the security log of the DC that states there was a Kerberos pre-authentication failure for the cluster network name object (Domain\Clustername$)
I believe this is what is causing the repair failure. All the information I found related to security error 4771 was either a bad credentials given for a user account or the fix was to reconnect the computer to the domain. I can't seem to find
a way to do this with the cluster network name. If there's a way please let me know.
I've tried a number of things, like resetting the object, disabling it, deleting and creating a new object with the same name, deleting that new object and recovering the original, etc...
Can anyone shed some light on what is going on and hopefully how to fix it other than rebuilding the cluster? I'm quite close to just tearing it down and building it back up but am hesitant because this cluster in currently in production...
Any help would be appreciated

Hi,
I don’t find out the similar issue with yours, base on my experience, the 4096 error
often caused by the CSV disk issue, and the 0x80005000 error some time caused by the repetitive computer object in OU. Please check the above related part or run the validate test then post the error information.
Although I do have a CSV, there doesn't seem to be any problems with it and it was running just fine for a month or so before the problem started. I double checked and there is no duplicate computer objects, maybe I don't understand what you mean by
repetitive, could you explain further?
The cluster validates successfully with a few warnings:
Validating cluster resource Name: DT-FileCluster.
This resource is marked with a state of 'Failed' instead of
'Online'. This failed state indicates that the resource had a problem either
coming online or had a failure while it was online. The event logs and cluster
logs may have information that is helpful in identifying the cause of the
failure.
- This is because the cluster name is in the failed state
Validating the service principal names for Name:
DT-FileCluster.
The network name Name: DT-FileCluster does not have a valid
value for the read-only property 'ObjectGUID'. To validate the service principal
name the read-only private property 'ObjectGuid' must have a valid value. To
correct this issue make sure that the network name has been brought online at
least once. If this does not correct this issue you will need to delete the
network name and re-create it.
- This is definitely related to the problem and the GUID probably got removed when we attempted a fix by resetting the object and trying the repair from the failover cluster manager.
The user running validate, does not have permissions to create
computer objects in the 'ad.unlv.edu' domain.
- This is correct, we run a restricted domain. I have a delegated OU that I can pre-provision accounts in. The account was pro-provisioned successfully and was at one point setup and working just fine.
There are no other errors nor warnings.

SSL Cert for 2008 R2 Reporting Services that is installed on a Failover Cluster - server address mismatch?

I utilized the idea from
http://www.mssqltips.com/sqlservertip/2778/how-to-add-reporting-services-to-an-existing-sql-server-clustered-instance/ to install 2008 R2 Reporting Services on a new Clustered SQL instance. In short, create the new Clustered SQL instance on Node1,
installing Reporting Services with it. Then on Node2, Add a Failover Cluster Node (without choosing Reporting Services); following that up with starting the SQL setup.exe with a cmd to bypass a check so that I can then install the Reporting Services
feature on Node2. It points out using the SQL Cluster Network name for connecting to Reporting Services.
I verified upon failover that I could still access the Reports and ReportServer URLs. However, when wanting to add an SSL certificate to the RS configuration, I run into the warning of "mismatched address - the security certificate presented by
this website was issued for a different website's address", where I can continue and get to the Reports or ReportManager URLs.
I played with different certs (internal CA created) and SANs and other things, but I still get this error with the cert. The Reports URL, for example, is <a href="https:///Reports">https://<SQLClusterNetworkName>/Reports, and the
cert has a CN and Friendly Name of SQLClusterNetworkName (with SAN of DNS: SQLClusterNetworkName.<domain>), but the error still happens.
What am I missing to eliminate the mismatched address warning when using the SQLClusterNetworkName as the base of the URLs?

I got it working by using the FQDN as the common name on the SSL cert, with FQDN in RS URLs.

Failover Cluster - GHOST VMS / ROLES

I mean Ghost as in mysterious non-existent machine, not the old Norton program. I've periodically had random cluster crashes, mainly due to my own negligence. 99%
of the time everything comes back up normally. However periodically a machine will have very strange symptoms that i'm unable to resolve. The only resolution I've found is to create a new VM and link to the the old VHD. A description of the
machines with this issue:
Shown in Failover Cluster role as Running but cannot Connect, turn off, shutdown, etc.
Login to Host machine for the VM and open Hyper-V Manager the machine does not exist. The only place this machine seems to exist is in Failover cluster.
No details available on the Summary Tab, machine doesn't actually appear to be running despite what the console says.
Under the resources tab for that Machine is shows the VM as running, but the VM Configuration as failed.
Unable to bring the configuration back online. Error is "The group or resource is not the correct state to perform the requested operation"
I've seen other vague areas about null context pointers or something alone those lines. I've tried researching the users methods to no avail. How can I fix these? Or at least remove them when i've recreated the machine.

Hi,
Unfortunately, the available information is not enough to have a clear view of the occurred behavior.Could you provide more information about your environment. The server version of the problem on, when this problem occurs the system log record information,
screenshots is the best information.
If you are using Server 2012R2 failover cluster please install the following update:
Recommended hotfixes and updates for Windows Server 2012 R2-based failover clusters
http://support.microsoft.com/kb/2920151
More information:
Event Logs
http://technet.microsoft.com/en-us/library/cc722404.aspx
Thanks.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Service Accounts for Reporting Service in SQL Server Failover Cluster setup

I am setting up 2 Report Services (SSRS) in SQL Failover Clustering (Version: 2012SP1) on Windows 2012, as part of scale out architecture.
There are 2 options to configure the service account for SSRS:
Option 1) Using domain accounts, as what I have done for DB Engine and SQL Agent.
Option 2) accept the default, which is virtual account for SSRS. Per documentation URL:
http://msdn.microsoft.com/en-us/library/ms143504.aspx
which is the recommended one? is it option 2?
There is security note on above URL as well, but does not clearly mention that option 1 is not recommended.
Security Note: Always run SQL Server services by using the lowest possible user rights. Use a MSA or virtual account when possible. When MSA and virtual accounts are not possible, use a specific low-privilege user account or domain account instead
of a shared account for SQL Server services. Use separate accounts for different SQL Server services. Do not grant additional permissions to the SQL Server service account or the service groups. Permissions will be granted through group membership or granted
directly to a service SID, where a service SID is supported.
Thanks very much for your help!

Hi Luo Donghua,
In SQL Server Failover Cluster Instance, personally two options can run well. If you use the virtual account for SQL Server Reporting Service. Virtual accounts in Windows Server 2008 R2 and Windows 7 are managed local accounts that provide the features to
simplify service administration. The virtual account is auto-managed, and the virtual account can access the network in a domain environment.
Of cause, you can also use domain accounts in your clustering.
Just make sure your service account is set up here, or that it is using a proper built-in account.For more information, see:http://ermahblerg.com/2012/11/08/cluster-ssrs-in-2008/
Thanks,
Sofiya Li
Sofiya Li
TechNet Community Support

WWW service is not able to start via Microsoft Failover Cluster generic service resource

Environment
Cluster Nodes = two
Cluster Nodes OS = Windows 2008R2
Application = IIS
Query
I created generic service resources of many windows services under Microsoft Failover Cluster and they are failing over successfully but when I create a generic service resource for WWW, then the WWW service is not able to online
via Microsoft Failover Cluster. It stuck in online pending.
I have noticed two things.
1.) If the WWW service is set to manual and started at passive node and I manually restart the Active node then the WWW service successfully switch over to stand by/passive node. but if the WWW service is set to
manual and not started on stand by/Passive node then the WWW service is not failing over.
2.) if I kill the WWW service manually (as a test case) on Active Node via this command (taskkill /f /pid XXXX) then the WWW service failed and is not failing
over to standby/passive node.
Any comment will be appreciated. Thanks. Zahid Haseeb.

The problem is resolved. I feel that it will be helpful to other people who may face the same problem which I faced, so I wrote a blog on "How to configure IIS Web Site and Application Pool in Microsoft Failover Cluster" and mentioned almost all activities
which I have done. Kindly see the resolution under section "Configure some changes in Cluster Configuration" in the below link
http://zahidhaseeb.wordpress.com/2014/02/12/how-to-configure-iis-web-site-and-application-pool-in-microsoft-failover-cluster/
Any comment will be appreciated. Thanks. Zahid Haseeb.

Installation of CRM 2007 in Windows with oracle and cluster environment

Dear Experts,
We are about to start the installation of CRM 2007 (ABAP+JAVA) with
Oracle 10g on Windows x64 in cluster environment. In the SAPINST dialog
box under High availability option, I could see installation options like ASCS
Instance, SCS Instance, First MSCS node, Database Instance, Additional
MSCS Node, Enqueue Replication Server, Central Instance and Dialog
Instance.
I have gone through the installation guide. I have below queries
regarding the same. Can you please clarify the same
1) Our requirement is we want to have an ACTIVE-ACTIVE cluster setup
with sap service running in Node A and Database running in Node B. Can
we have this setup in ABAP+JAVA setup
2) Also,in the SAPINST dialog box as said above except last two
(Central and Dialoge instance) as per standard installation guide are
to be installed in shared drives as per the requirement. But, central
and dialog are said to be installed locally on any one node in MSCS or
in separate server. As per my understanding Dialog instance will be
used for load balancing which we do not require now. Hence I feel this
is optional in our case. Where as Central Instance I am not able to
understand why this option is for? Is it mandatory to be installed or optional. If
so, when I installed it in one of the MSCS node the incase of failover
how does it effect the system. As per my understanding ASCS and SCS
comprise central instance.
Please clarify and thanks in advance.
Regards,
Sharath Babu M
+91-9003072891

I am following as per the standard installation guide.
Regards
Sharath

AD CS Certificate WebEnrollment in Failover Cluster Environment - W2K8 R2

Similar Messages

Maybe you are looking for