Fix: Adding special permissions to the cluster computer object failed


You have two or more 2012 R2 up-to-date nodes and want to create new failover cluster. Logged user is Domain Admin.

You install the required features:

Install-WindowsFeature FailoverClustering -IncludeManagementTools

Run validation tests and it’s green:

Test-Cluster -Node node1,node2

Run cluster creating:

New-Cluster -Name TestCluster -Node node1,node2 -StaticAddress -NoStorage

and you receive:

Adding special permissions to the computer object failed. Trying to add ‘Full-Access’ permissions for security principal to computer object CN=,OU=,DC=,DC= failed. Verify that the user running create cluster has permissions to update the computer object in Active Directory Domain Services. The parameter is incorrect.

  • Steps for prestaging required objects don’t work too.
  • Changing user rights or adding new user for cluster creating  –>  no luck
  • No time synchronization issues between nodes and DCs
  • Networks are configured properly
  • Validation tests are all “green”
  • Firewall is disabled


1. Create new computer object for cluster name (Go to ADUC –> your OU –> new –> computer)

cluster creating error 1

3. Turn on view with advanced features

cluster creating error 3

4. Right click on CNO (computer object for new cluster) and go to Security tab –> select Advanced

cluster creating error 4

5. Click on “Disable Inheritance” (for 2012/2012 R2) or clear “Allow inheritable permissions from parent to propagate to this object and all the child objects” (2008/2008R2) and “Remove all inherited permissions from this object”

cluster creating error 5

6. Right click on the new cluster name and disable it (prestaged computer object from step 1)

cluster creating error 2

7. Go back to the failover cluster wizard and try to create cluster again

Step-By-Step: Cluster OS Rolling Upgrade in Windows Server Technical Preview


Today we discuss new feature in Windows Server Technical Preview (vNext or Windows Server 10) – Cluster Operating System Rolling Upgrade * WIndows Server 2016 RTM is available. CRU process is the same.

Cluster OS Rolling Upgrade (CRU) is a new feature in Windows Server Technical Preview that enables an administrator to upgrade the operating system of the cluster nodes from Windows Server 2012 R2 to Windows Server Technical Preview without stopping the Hyper-V or the Scale-Out File Server workloads.

Cluster OS Rolling Upgrade provides the following benefits:

  • Hyper-V virtual machine and Scale-out File Server workloads can be upgraded ONLY from Windows Server 2012 R2 to Windows Server Technical Preview without downtime. Other cluster workloads will be unavailable during the time it takes to failover to Windows Server Technical Preview.
  • It does not require any additional hardware.
  • The cluster does not need to be stopped or restarted.
  • A new cluster is not required. In addition, existing cluster objects stored in Active Directory are used.
  • The upgrade process is reversible until the customer crosses the “point-of-no-return”, when all cluster nodes are running Windows Server Technical Preview, and when the Update-ClusterFunctionalLevel PowerShell cmdlet is run.
  • The cluster can support patching and maintenance operations while running in the mixed-OS mode.
  • It supports automation via PowerShell and WMI + VMM 2016 supports CRU.
  • The ClusterFunctionalLevel property indicates the state of the cluster on Windows Server Technical Preview cluster nodes.

The following scenarios are not supported in Windows Server Technical Preview:

  • Cluster OS Rolling Upgrade of a cluster using storage with the Data Deduplication feature
  • Cluster OS Rolling Upgrade of virtual machines with Data Protection Manager (DPM) backups
  • Cluster OS Rolling Upgrade of guest clusters using virtual hard disk (.vhdx file) as shared storage
  • UPDATE: Rolling Upgrade from technical preview (TP) 1 to TP2 is not supported too!

My sample cluster configuration (named as HVCL) are based on two Windows Server 2012 R2 nodes (hv01, hv02) and SMB storage (fs01) as shown on the picture below:


On my hosts I use converged networks :

  • 2 ports on each nodes in teamed mode

  • Hyper-V switch use this teamed adapter

  • “virtual” networks (, for cluster and management


Windows Server Technical Preview | 64-bit ISO

Go to Windows Evaluation Portal , sign in , review preinstall information

1. Review Windows Server Technical Preview release notes and system requirements

2. Register, then download and install the preview. Technical Preview expires April 15, 2015. Want to keep going with Technical Preview? Click here for more information.

3. Receive email with resources to guide you through your preview

Installation Guidelines

Upon installation, you will be prompted to activate. A product key is not required for the ISO installation.

VHD installation requires the following product key:


Don’t worry about expiration. Microsoft has released extension (will be described later).

Download ISO and make an bootable drive.  You can use Windows 7 USB DVD Download Tool. It works like a charm.


Windows Server Technical Preview has and it’s RTM version will have SLAT requirement for Hyper-V hosts CPU. SLAT was not a requirement in the previous versions of Windows Server (but it was required on Windows Clients)


It’s highly recommended to have up-to-date 2012 R2 hosts.
Check cluster events and solve warnings/errors if it appears.
Perform full backup of cluster database. Stop all backup jobs before upgrading.

Upgrade steps

Get list of cluster nodes

PS C:\Windows\system32> Get-ClusterNode

Name                 ID    State
----                 --    -----
hv01                 2     Up
HV02                 1     Up

Disable CAU (Cluster Aware Updates) role if it’s enabled


Drain the node (HV01 in my case), then remove one from cluster

Suspend-ClusterNode -Node HV01
Remove-ClusterNode -Node HV01

Plug in boot drive with new Windows Server , restart server and switch to boot menu, perform CLEAN OS install (re-format system volume, install WS)


In first logon you may notice that current build requires to update, go to Windows Update and perform updates search.

Check that build is up-to-date and KB3056022 is installed. This KB will allows you to continue using the Windows Server Technical Preview and Hyper-V Server Technical Preview from October 2014 without interruption until the next preview is available in May 2015.* Only for TPs. RTM does not require that

Install Hyper-V and Failover Clustering roles

Add-WindowsFeature Hyper-V, Failover-Clustering -IncludeManagementTools -Restart

Generally it takes 2 restarts until Hyper-V role install.

Before adding to cluster you have to set up your networks.

In my case, I have to create new teamed adapter

New-NetLbfoTeam -Name HV -TeamMembers tNIC1,tNIC2 -TeamingMode SwitchIndependent -LoadBalanci
ngAlgorithm Dynamic

Are you sure you want to perform this action?
Creates Team:'HV' with TeamMembers:{'tNIC1', 'tNIC2'}, TeamNicName:'HV', TeamingMode:'SwitchIndependent' and
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is Y): y

Name                   : HV
Members                : {tNIC2, tNIC1}
TeamNics               : HV
TeamingMode            : SwitchIndependent
LoadBalancingAlgorithm : Dynamic
Status                 : Down

Note: it’s recommended to use Dynamic Load Balancing (since 2012 R2) for Hyper-V workloads
To create Hyper-V Switch I use New-VMSwitch , teamed adapter and I don’t allow to share this adapter with OS. SET (Switch Embedded Teaming only supported in Windows Server 2016)

PS C:\Users\Administrator; New-VMSwitch -InterfaceAlias HV -Name VM -MinimumBandwidthMode Weight -AllowManagementOS 0

Name SwitchType NetAdapterInterfaceDescription
---- ---------- ------------------------------
VM   External   Microsoft Network Adapter Multiplexor Driver

To add additional network adapters (one for CSV traffic and other for management purposes) use Add-VMNetworkAdapter (No QoS guys, it’s just a demo)

PS C:\Windows\system32> Add-VMNetworkAdapter -Name CSV -SwitchName VM -ManagementOS
PS C:\Windows\system32> Add-VMNetworkAdapter -Name LAN -SwitchName VM -ManagementOS

If you open ncpa.cpl you can see 2 new adapters with vEthernet prefix. Now you can set IP/DNS settings on each of them and add machine to domain from GUI or powershell.

To define IP/DNS in powershell:

New-NetIPAddress -IPAddress -InterfaceAlias "vEthernet (LAN)" -PrefixLength 24 -AddressFamily IPv4
New-NetIPAddress -IPAddress -InterfaceAlias "vEthernet (CSV)" -PrefixLength 24 -AddressFamily IPv4
Set-DnsClientServerAddress -InterfaceAlias "vEthernet (LAN)" -ServerAddresses,

Add machine
with the previous name (HV01) to domain and restart:

Add-Computer -DomainName -DomainCredential domain\r.levchenko
Restart-Computer -Force

Now we are ready to add host back to existing HVCL cluster:

PS C:\Windows\system32> Add-ClusterNode -Cluster
PS C:\Windows\system32> Get-ClusterNode

Name                 ID    State
----                 --    -----
hv01                 2     Up
hv02                 1     Up

Perform test live migration
between 2012 R2 node and TP:

PS C:\Windows\system32> Move-ClusterVirtualMachineRole SC_VMMR2 -Node HV02 -Verbose
VERBOSE: Connecting to cluster on local computer HV02.
VERBOSE: Moving virtual machine 'SC_VMMR2' to node HV02.

Name                                    OwnerNode                               State
----                                    ---------                               -----
SC_VMMR2                                hv02                                    Online

Move all roles from 2012 R2 node to Windows Server TP node
(drain node, Suspend-ClusterNode) and repeat all steps for the second node (HV02 in my case)

When all nodes have new version of Windows Server installed , you have to update cluster functional level

*in mixed mode (RTM + 2012 R2) cluster level is 8.0. after updating – 9.0.

PS C:\Windows\system32> Update-ClusterFunctionalLevel

Updating the functional level for cluster hvcl.
Warning: You cannot undo this operation. Do you want to continue?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is Y): a


To enable new Hyper-V features you must update current VM version level.

In Windows Server 2012 R2 , VMs have version 5.0

PS C:\Windows\system32> get-vm|select name,version

Name                                                        Version
----                                                        -------
SC_VMMR2                                                    5.0
sql-01                                                      5.0

After implementing new configuration level, VM’s version will be changed to 6.0 .

*in Windows Server 2016 RTM VM’s version is 8.0

#Get ALL VMs in cluster
PS C:\Windows\system32> Get-ClusterGroup|? {$_.GroupType -EQ "VirtualMachine"}|Get-VM|Update-VMVersion

Are you sure you want to perform this action?
Performing a configuration version update of "New Virtual Machine" will prevent it from being migrated to or imported on previous versions of Windows. This operation is not reversible.

[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is Y): a

PS C:\Windows\system32> get-vm|select name,version

Name                                                                                            Version
----                                                                                            -------
SC_VMMR2                                                                                        6.0
sql-01                                                                                          6.0

Note: you MUST stop VMs before upgrading it’s version.

Update-VMConfigurationVersion : The operation cannot be performed while the virtual machine is in its current state.
The name of the virtual machine is sql-01 and its ID is 8f9312b0-0910-4e79-b267-41c2bc2057c1.
At line:1 char:56

To stop ALL VMs in cluster:

#Stop VMs in the cluster
Get-ClusterGroup|? {$_.GroupType -EQ "VirtualMachine" -and $_.State -eq "Online"}|Get-VM|Stop-VM

#Check VM state
PS C:\Windows\system32> Get-ClusterGroup|? {$_.GroupType -EQ "VirtualMachine"}

Name                                                            OwnerNode                                                       State
----                                                            ---------                                                       -----
New Virtual Machine                                             hv01                                                            Offline
SC_DPMR2                                                        hv01                                                            Offline
SC_VMMR2                                                        hv02                                                            Offline
SCVMM srv-adfs-01 Resources                                     hv01                                                            Offline
SCVMM srv-adfsp-01 Resources                                    hv01                                                            Offline
SCVMM testVM Resources                                          hv01                                                            Offline
SCVMM WAPPortal Resources                                       hv01                                                            Offline
sql-01                                                          hv02                                                            Offline

Enable Cluster Aware Updates


If you have Storage Pool you have to update it:



To cluster rolling upgrade to Windows Server Technical Preview you have to complete the following steps:

  • backup cluster database and workload data
  • disable CAU role if it is enabled
  • for each 2012 R2 cluster node: drain node, evict node from cluster, perform clean OS install, update OS, add Hyper-V and WSFC roles, set network for cluster and storage communications, add machine to domain, add machine back to cluster, check live migration and basic functionality
  • when all nodes are Windows Server Technical Preview, update VM (must be offline) and cluster levels, enable CAU, update storage pool if it is necessary

If your VMs cannot start after Update-VMConfigurationVersion, see my post:



Is it possible to upgrade Windows Server 2012 and earlier version in the same manner?

No. MS do not have any plans to port this feature to other Windows Servers.

Is it possible to manage cluster with mixed OS?

Yes. But you have to manage cluster from Windows Server Technical Preview. It’s not supported to manage from 2012 R2.

Can I use Windows Server Technical Preview in production?

It’s not recommended. Just wait for RTM version of new Windows Server.

%d bloggers like this: