Corrupt Cluster Computer Accounts in AD

  • I ran into this issue months ago and never found an easy solution.

    SQL Server 2005 Enterprise sp 3 x64

    Cluster 2008 R1 SP1

    Scenario:

    During a Disaster Recover exercise, a duplicate production network was created on a network that was disconnected from our live production environment.

    This DR network included a identically named network with AD controllers and various identically named servers and clusters.

    The nightmare began when someone accidentally reconnected the two networks together before the DR Active Directory controllers were destroyed.

    The DR domain controllers replicated and computer accounts were overwritten in or live evironment.

    SQL CLusters on Cluster 2003 seemed to survive ok due to the fact there is no heavy use of computer account objects in the same way Cluster 2008 uses them.

    The SQL CLUSTERS on CLUSTER 2008 however faced a different situation. When the computer account objects of the Cluster account and one of the SQL clusters was overwritten in AD, the SQL Cluster Name and CLuster name no longer would come back on-line.

    Microsoft-Windows-FailoverClustering 1207 Error 19

    After many hours with MS the solution seemed to be to restore active directory.

    We opted to reinstall the cluster and instance.

    Now I am looking back and wondering if there was a way to get the computer account objects

    to sync back up with the services. Or was AD restore or Cluster reinstall the only option.

    We never did try deleting the account objects and recreating them but I think it would have had the same result as overwriting them with DR account objects.

    I know for a server you can fix a computer account and this involves leaving the domain and coming back into the domain. Is this even possible with Cluster servers?

    All thoughts are welcome.

    Thanks

  • Because you are running a Server 2008 cluster I assume that you are using 2008 AD as well.

    I would take AD snapshots before any DR exersize at a minimum, then in situations like this you can mount the AD snapshot and restore only the affected objects within AD.

    Hope this helps...

  • Thanks for the reply. Unfortunately AD is still 2003.

    A good point though and a valid reason to upgrade.

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply