Could not get domain controller name from machine

Question

While validating a Failover Cluster over two member servers I get the following two errors:

1. Connectivity to a writable domain controller from node SQL2.domain.com could not be determined because of this error: Could not get domain controller name from machine SQL2.
2. Node(s) SQL2.domain.com cannot reach a writable domain controller. Please check connectivity of these nodes to the domain controllers.

If I run the Failover Cluster from SQL2.domain.com I get the same errors about SQL1.domain.com .

I have disabled IPv6 on the DC and SQL1/2, rebooted the servers after each attempt and removed/rejoined the member servers in the domain and nothing worked.

Both servers use only one DNS server which is the DC and the DC has public DNS servers setup in the forwarders list. This is a vanilla installation with no Firewall, DNS or LDAP changes.

From both member servers I can perform nslookup on the domain name and domain controller FQDN and it's responding for ICMP.

Solution 1

Since the day I posted this I've found out that the problem was that I was trying to create the failover cluster on a domain controller.

Solution 2

This could be a permissions issue on your AD.

The user who is creating the cluster, or in your case running the validation wizard, must be able to create computer objects/accounts in AD. I would first check that.

When running the Failover Cluster Wizards an computer name object (CNO) is created for the cluster, if this fails, you may experience the error as shown.

You can "prestage" this account by manually creating the computer object for your cluster, with the exact name you are going to give your cluster, by creating this in the computers container. You should give it the "Create Computers objects" and "Read all Properties" permissions in the container you create the object. (which should be the computers container of the domain)

A more details step-by-step for prestaging is listed here: https://technet.microsoft.com/en-us/library/cc731002(v=ws.10).aspx#BKMK_steps_precreating

But I would start with checking the permissions of the user account which is used to create the cluster / run the validation wizard, that is a lot easier to do then to prestage.

Please let us know your progress. HTH, Edwin.

Comments

[blacklight]

This sounds like your DNS is misconfigured. Can you please verify your domain controller's registration in DNS. technet.microsoft.com/en-au/library/cc738991(v=ws.10).aspx

[Paul]

I've ran dcdiag /test:dns on the DC and it didn't report any problems and I get a valid response for nslookups for _ldap._tcp.dc._msdcs.domain.com on all member servers.

[blacklight]

Did the nslookup for _ldap._tcp.dc._msdcs.domain.com return the actual names of your DCs? I'm interested to see if your reverse lookup zones are working.

[joeqwerty]

Reverse Lookup Zones aren't a component of AD and aren't required by AD and shouldn't be relevant to the problem.

[blacklight]

Yes I'm not even sure where I was going with that, disregard that comment.

[CaM]

You renamed the DC... that could be your issue. This article says how to safely rename a DC: technet.microsoft.com/en-us/library/cc816601(v=ws.10).aspx