Fix: Adding special permissions to the cluster computer object failed

Scenario

You have two or more 2012 R2 up-to-date nodes and want to create new failover cluster. Logged user is Domain Admin.

You install the required features:

Install-WindowsFeature FailoverClustering -IncludeManagementTools

Run validation tests and it’s green:

Test-Cluster -Node node1,node2

Run cluster creating:

New-Cluster -Name TestCluster -Node node1,node2 -StaticAddress 192.168.1.100 -NoStorage

and you receive:

Adding special permissions to the computer object failed. Trying to add ‘Full-Access’ permissions for security principal to computer object CN=,OU=,DC=,DC= failed. Verify that the user running create cluster has permissions to update the computer object in Active Directory Domain Services. The parameter is incorrect.

  • Steps for prestaging required objects don’t work too.
  • Changing user rights or adding new user for cluster creating  –>  no luck
  • No time synchronization issues between nodes and DCs
  • Networks are configured properly
  • Validation tests are all “green”
  • Firewall is disabled

Solution

1. Create new computer object for cluster name (Go to ADUC –> your OU –> new –> computer)

cluster creating error 1

3. Turn on view with advanced features

cluster creating error 3

4. Right click on CNO (computer object for new cluster) and go to Security tab –> select Advanced

cluster creating error 4

5. Click on “Disable Inheritance” (for 2012/2012 R2) or clear “Allow inheritable permissions from parent to propagate to this object and all the child objects” (2008/2008R2) and “Remove all inherited permissions from this object”

cluster creating error 5

6. Right click on the new cluster name and disable it (prestaged computer object from step 1)

cluster creating error 2

7. Go back to the failover cluster wizard and try to create cluster again

Windows Server 2012 R2 update: June, 2014

Another update for Server 2012 R2. A lof of issues , related with WSFC and Hyper-V, have been fixed in this cumulative update:

  • 2961977 “Hyper-V Replica Cluster Broker is not installed” error when you replicate private clouds to Windows Azure
  • 2964723 Connectivity lost between two nodes when a node reconnects to a Windows Server 2012 R2-based cluster
  • 2964725 Removed nodes can access shared disk resources unexpectedly in Windows Server 2012 R2
  • 2964729 You cannot stop the cluster service on a Windows Server 2012 R2-based failover cluster
  • 2964730 Storage spaces take a long time to move to another node after a node fails on a Windows Server 2012 R2 failover cluster
  • 2964814 Virtual machine network fails when you start the second VM on a Windows Server 2012 R2-based Hyper-V server
  • 2965074 Error occurs when you run Get-VirtualDisk|Get-ClusterResource cmdlet in Windows 8.1 or Windows Server 2012 R2
  • 2965699 “There was a problem” error when you redeem a promotional CSV token in Windows 8.1 or Windows Server 2012 R2
    …………………

Like the previous update (may), this CU requires installed April CU

More info: http://support.microsoft.com/kb/2962409/en-us

TIP: read my post about May CU