ÇÔ¸Õ¡ÒÃãªéºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃì·ÕèÊÃéÒ§ÍÕ¡¤ÃÑ駴éǵ¹àͧ

ã¹ÃÐËÇèÒ§¡Ãкǹ¡ÒõԴµÑé§ÊÓËÃѺ¡ÒúÃÔ¡ÒäÅÑÊàµÍÃì¢Í§ Microsoft ºÑ­ªÕâ´àÁ¹·ÕèÃкØä´éÃѺÊÔ·¸Ôì·Õè¨Óà»ç¹ÊÓËÃѺ¡ÒúÃÔ¡ÒäÅÑÊàµÍÃì·Ó§Ò¹ÍÂèÒ§¶Ù¡µéͧ ¶éҤسà¤ÂÁÕ¡ÒÃà»ÅÕè¹á»Å§ ËÃ×ͺѭªÕ¼Ùéãªé·ÕèÊÃéÒ§ãËÁèÍÕ¡¤ÃÑé§ ¤Ø³µéͧãËéÊÔ·¸Ôì㹡ÒáÅѺ仺ѭªÕâ´àÁ¹·Õèãªé㹡ÒÃàÃÔèÁ¡Ò÷ӧҹ¢Í§ºÃÔ¡ÒäÅÑÊàµÍÃì º¹áµèÅÐâ˹¢Í§¤ÅÑÊàµÍÃì ´éǵ¹àͧ ¹Í¡¨Ò¡¹Õé µÃǨÊͺãËéá¹èã¨ÇèÒ ¹âºÒ¤ÇÒÁ»ÅÍ´ÀÑÂäÁèä´éźÊÔ·¸ÔËÃ×ÍÊÔ·¸Ô¨Ò¡ºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃì ¶éÒÊÔ·¸ÔìËÃ×ÍÊÔ·¸Ôì¨Ð¶Ù¡àÍÒÍÍ¡¨Ò¡ºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃì ºÃÔ¡ÒäÅÑÊàµÍÃìÍÒ¨äÁè·Ó§Ò¹

ºÑ­ªÕ·Õèãªéà¾×èÍàÃÔèÁ¡Ò÷ӧҹ¢Í§ºÃÔ¡ÒäÅÑÊàµÍÃìµéͧÁÕ¤èÒ¹éÍÂÊØ´¢Í§ºÑ­ªÕ USER â´àÁ¹ÃдѺ áÅеéͧ¶Ù¡à¾ÔèÁà¢éÒä»ã¹¡ÅØèÁ¼Ùé´ÙáÅÃкºÀÒÂ㹺¹áµèÅÐâ˹´ã¹¤ÅÑÊàµÍÃì à¾ÔèÁºÑ­ªÕãËé¡Ñº¡ÅØèÁ¼Ùé´ÙáÅ·éͧ¶Ôè¹ã¹áµèÅÐâ˹´ã¹¤ÅÑÊàµÍÃì â´Â¡ÒÃãªéà¤Ã×èͧÁ×Í¡ÒèѴ¡ÒüÙéãªéã¹ Microsoft Windows NT 4.0 ËÃ×ͨѴ¡ÒäÍÁ¾ÔÇàµÍÃì ã¹ à«ÔÃì¿àÇÍÃì¢Í§ Microsoft Windows 2000 ËÃ×Í ã¹ Microsoft Windows Server 2003

ËÁÒÂà˵Ø:¨Ó¹Ç¹¢Í§ÊÔ·¸Ôì·ÕèÃкØäÇéã¹Êèǹ¹Õéä´éÃѺ¡ÒáÓ˹´ "â´Â¾ÃçÍ¡«Õ ºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃìµéͧà»ç¹ÊÁÒªÔ¡¢Í§¡ÅØèÁ¼Ùé´ÙáÅÃкºÀÒÂ㹺¹â˹´ ´Ñ§¹Ñé¹ ¶éÒ¢ÇÒ·Õè੾ÒСÅØèÁ¼Ùé´ÙáÅ·éͧ¶Ôè¹ â´Â»¡µÔ¤Ø³äÁè¨Óà»ç¹µéͧà¾ÔèÁºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃì ÍÂèÒ§äáçµÒÁ ¶éҤس¡ÓÅѧÁջѭËҡѺÊÔ·¸ÔìÊÓËÃѺºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃì ¤Ø³ÊÒÁÒöà»Ô´ãËéÊÔ·¸Ôì·Ñé§ËÁ´â´ÂµÃ§ä»ºÑ­ªÕ·ÕèàÃÔèÁºÃÔ¡ÒäÅÑÊàµÍÃì ã¹ Windows Server 2003 ¤Ø³µèÒ§ËÒ¡µéͧ¡Ó˹´ºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃìãËé¡Ñº¡ÅØèÁ¼Ùé´ÙáÅÃкºÀÒÂ㹢ͧáµèÅÐâ˹´ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺËÑÇ¢éÍ·Õèà¡ÕèÂÇ¢éͧ â»Ã´¤ÅÔ¡ËÁÒÂàÅ¢º·¤ÇÒÁµèÍ仹Õéà¾×èÍ´Ùº·¤ÇÒÁã¹ Microsoft Knowledge Base::µÃǨÊͺãËéá¹èã¨ÇèÒ ä´éÃѺÊÔ·¸Ôì¢Í§¼ÙéãªéµèÍ仹Õé㹡ÅØèÁ¼Ùé´ÙáÅÃкºÀÒÂã¹ËÃ×ÍÃдѺ¤ÅÑÊàµÍÃìºÃÔ¡ÒúѭªÕâ´àÁ¹

Windows Server 2003

ËÁÒÂà˵Ø:¶éҤسà»ÅÕ蹺ѭªÕ¼Ùéãªé·Õè¶Ù¡ãªéà¾×èÍàÃÔèÁ¡Ò÷ӧҹ¢Í§ºÃÔ¡ÒäÅÑÊàµÍÃì ¤Ø³µéͧãªé¡ÒèѴ¡ÒäÍÁ¾ÔÇàµÍÃìÊÓËÃѺ Windows Server 2003 à¾×èÍà»ÅÕè¹á»Å§¢éÍÁÙźѭªÕ¼Ùéãªéº¹áµèÅÐâ˹´ã¹¤ÅÑÊàµÍÃì â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::

1. àÃÔèÁ¡Ò÷ӧҹ¢Í§¤ÍÁ¾ÔÇàµÍÃì¡ÒèѴ¡ÒÃÊÓËÃѺ Windows Server 2003 ¢ÂÒºÃÔ¡ÒÃáÅÐâ»Ãá¡ÃÁ»ÃÐÂØ¡µìbranch áÅШҡ¹Ñé¹ ¤ÅÔ¡¡ÒúÃÔ¡ÒÃÊÒ¢Ò
2. 㹺ҹ˹éÒµèÒ§´éÒ¹¢ÇÒ ¤ÅÔ¡Êͧ¤ÃÑ駺ÃÔ¡ÒäÅÑÊàµÍÃì. àÅ×Í¡¡ÒÃÅçÍ¡ÍÔ¹á·çº áÅШҡ¹Ñé¹ »ÃѺ»Ãا¢éÍÁÙźѭªÕ¼Ùéãªé

àÁ×è͵éͧ¡Ò÷ӧҹÍÂèÒ§¶Ù¡µéͧ㹠Microsoft Windows Server 2003 ºÑ­ªÕºÃÔ¡ÒäÅÑÊàµÍÃìµèÒ§ËÒ¡µéͧÊÔ·¸ÔìµèÍ仹ÕéÊÓËÃѺâ˹·Ñé§ËÁ´ã¹¤ÅÑÊàµÍÃì:

• ·Ó˹éÒ·Õèà»ç¹Êèǹ˹Ö觢ͧÃкº»¯ÔºÑµÔ¡ÒÃ
• ¡ÒûÃѺ»Ãاâ¤ÇµéҢͧ˹èǤÇÒÁ¨ÓÊÓËÃѺ¡Ãкǹ¡ÒÃ
• ÊÓÃͧä¿ÅìáÅÐä´àá·ÍÃÕ
• à¾ÔèÁÃдѺ¤ÇÒÁÊӤѭ·Õè¨Ñ´¡Ó˹´¡ÒÃ
• à¢éÒÊÙèÃкºà»ç¹¡ÒúÃÔ¡ÒÃ
• ¤×¹¤èÒá¿éÁáÅÐä´àá·ÍÃÕ

Also, make sure that the Local Administrator Group has access to the following user rights:

• Debug programs
• Impersonate a client after authentication
• Manage auditing and security log

You can grant these rights in the following locations:ËÁÒÂà˵Ø:If you create a Group Policy setting to update theImpersonate a client after authentication rightspolicy setting, make sure that the Cluster service account is listed in the policy setting in addition to the Local Administrators group and the account that is called SERVICE. If the Cluster service account is not listed, the computer may no longer have access to Windows Management Instrumentation (WMI). By default, these accounts are listed in theImpersonate a client after authentication rights¹âºÒÂ: However, if you create a Group Policy setting without adding the Cluster service account, the local policy setting is overwritten, and WMI access fails.

windows 2000 Server

ËÁÒÂà˵Ø:If you change the account that is used to start the Cluster service, follow these steps:

1. From the desktop, clickàÃÔèÁ¡Ò÷ӧҹáÅéÇ ¤ÅÔ¡â»Ãá¡ÃÁ·Ñé§ËÁ´.
2. ¤ÅÔ¡à¤Ã×èͧÁ×Í¡ÒôÙáÅÃкºáÅéÇ ¤ÅÔ¡ºÃÔ¡ÒÃ. 㹺ҹ˹éÒµèÒ§´éÒ¹¢ÇÒ ¤ÅÔ¡Êͧ¤ÃÑé§Cluster Service.
3. àÅ×Í¡¡ÒÃÅçÍ¡ÍÔ¹tab, and update the account information.

The Cluster service account requires the following rights on all nodes in the cluster to function correctly:

• Act as part of the operating system.
• Back up files and directories.
• Increase quotas.
• Increase scheduling priority.
• Load and unload device drivers.
• Lock pages in memory.
• Log on as a service.
• Restore files and directories.

Also, make sure that the Local Administrator Group has access to the following user rights:

• Debug programs
• Impersonate a client after authentication
• Manage auditing and security log

You can grant these rights in the following location:

Windows NT 4.0

To configure the user rights on a Windows NT 4.0 cluster node, clickµÑǨѴ¡ÒüÙéãªé¤ÅÔ¡¹âºÒ¤ÅÔ¡ÊÔ·¸Ôì¢Í§¼Ùéãªé. µÃǨÊͺãËéá¹èã¨ÇèÒ ¤Ø³¤ÅÔ¡áÊ´§ÊÔ·¸Ôì¢Í§¼Ùéãªé¢Ñé¹ÊÙ§.

The Cluster service account requires the following rights on all nodes in the cluster to function correctly:

• ÊÓÃͧä¿ÅìáÅÐä´àá·ÍÃÕ
• Increase quotas
• Increase scheduling priority
• Load and unload device drivers
• Lock pages in memory
• Log on as a service
• ¤×¹¤èÒá¿éÁáÅÐä´àá·ÍÃÕ

Additional things to consider

When you remove a required right from the Cluster service account, you may cause unexpected behavior. The Cluster service may not start, or the service may not create certain clustered resources or bring these resources online. For example, if the Cluster service or the local administrator group does not have a particular user right, theManage auditing and security loguser rights assignment cannot create a Microsoft Distributed Transaction Coordinator (MSDTC) resource because the Cluster service cannot create the required crypto checkpoint settings.

Another example of this problem may occur when you modify theAccess this computer from the networkuser right. You can modify this user right in the following location:By default, the Everyone and Administrator groups are both assigned this right. However, if you remove this right from these groups, and you do not specifically add the Cluster service account, you may not be able to join nodes to an existing cluster. Additionally, you may receive an "Access Denied" error when you try to access the cluster by using Cluster Administrator (Cluadmin.exe).

If an organization implements Group Policy objects that override the local security policies and that remove a user right from the Cluster service by changing the effective user rights, the Cluster service will fail at some point. àÁ×è͵éͧ¡ÒÃá¡é»Ñ­ËÒ¹Õé ãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé:

1. Create an organizational unit (OU) in the domain or in the forest, and then block policy inheritance on that OU.
2. Move the cluster nodes into the OU.
3. To inherit the new user rights, stop and restart the Cluster service on each node.

If you have Kerberos authentication enabled for any one of a cluster's virtual servers, and you change the Cluster service account, you may affect access to the computer object in Active Directory directory service. Before you enable the Kerberos protocol for any virtual servers, see the following Microsoft Knowledge Base article:Additionally, make sure that the Cluster service has the following user rights for computer objects in the appropriate OU:

• Reset password
• Change password
• Validated write to DNS Host Name
• Validated write to ServicePrincipalName