¤Ó͸ԺÒÂà¡ÕèÂǡѺ¤Ø³ÊÁºÑµÔ¢Í§¤ÅÑÊàµÍÃì·ÃѾÂҡê×èÍà¤Ã×Í¢èÒÂã¹ Windows Server 2003

This article describes the properties that are available for the Network Name resource in Microsoft Windows Server 2003 that are not included in earlier versions of Windows.

One of the features of the Network Name resource in Windows Server 2003 is the ability to create a computer object in Active Directory that allows programs to use Kerberos as an authentication protocol when the program contacts a service by using a cluster virtual name. Programs on a virtual server that are Active Directory aware now have a correctly-maintained Active Directory computer object. Other features include better DNS integration and three status indicators for NetBIOS, DNS, and Kerberos. The rest of this article describes how to enable and use these features.

Enable Kerberos authentication

ËÁÒÂà˵Ø:You receive the following error message if you try to set the Enable Kerberos Authentication option without taking the Network Name resource offline:A VirtualServer is comprised of a Network Name and IP Address resource. The Network Name resource has been updated for Windows Server 2003 to enable the use of Kerberos authentication and the creation of a corresponding computer object. By default, Kerberos authentication and the creation of a computer object for the VirtualServer is disabled and NTLM is used for authentication. To enable the Kerberos authentication and the creation of a computer object:

1. Start Cluster Administrator, right-click the Network Name resource, and then clickTake Offline.
   
   ËÁÒÂà˵Ø:Access to the VirtualServer by clients cannot now occur because the Network Name resource is now offline.
2. Double-click the Network Name resource where you want to enable Kerberos authentication to view the properties for the resource, and then click the¾ÒÃÒÁÔàµÍÃìá·çº
3. ¤ÅÔ¡¡ÒáÒÃà»Ô´ãªé§Ò¹¡ÒÃÃѺÃͧ¤ÇÒÁ¶Ù¡µéͧ KerberosµÑÇàÅ×Í¡ ¤ÅÔ¡µ¡Å§, right-click the Network Name resource, and then click¹Ó·Ò§Í͹äŹì. A client can now use Kerberos authentication when it connects to the VirtualServer. If you view the Active Directory Users and Computers MMC, a new computer object that correlates to the Network Name resource is visible.

The Cluster service must have the proper permissions to create computer objects in the Active Directory. This should occur by default because the Cluster service, at the minimum, has to be a domain user. By default, this group has the "Add workstations to a domain" privilege.

By default, domain users are limited to creating ten computer objects in the Active Directory. To create more computer objects, you must increase the limit, or the domain administrator can pre-create the computer objects. If the domain administrator gives explicit "Create Computer Objects" rights to the Cluster service account, the quota is over-ridden. If the computer object is pre-created, the Cluster service account will need proper permissions to be able to "hijack" the object so that it can write the correct attributes to it.

The three attributes that are written to the VirtualServer's computer object are:

• DnsHostName- This is created from the Network Name resource and the Cluster's primary DNS suffix.
• ServicePrincipalName- Like the DnsHostName, this is created from the Network Name resource and the Cluster's primary DNS suffix in the following format:
  
  HOST/VirtualServer's NetBIOS name
  HOST/FQDN for the VirtualServer
  MSClusterVirtualServer/VirtualServer's NetBIOS name
  MSClusterVirtualServer/FQDN for the VirtualServer
  MSServerCluster/VirtualServer's NetBIOS name(This SPN is only created for the default Cluster Name)
  MSServerCluster/FQDN for the VirtualServer(This SPN is only created for the default Cluster Name)
• DisplayName- This is the friendly name for the computer object as it appears in the directory or address book. This is the Network Name resource's NetBIOS name. Default access may prevent the DisplayName from being updated. However, it is not problematic if it cannot write the change, and the resource will come online.

In addition, a password is set on the computer object.

You can view these attributes by using the Adsiedit.msc utility that is included on the Windows Server 2003 CD-ROM in the SUPPORT folder.

You can view the primary DNS suffix by running theipconfig/·Ñé§ ËÁ´¤ÓÊÑ觷Õè¾ÃéÍÁ·ì¤ÓÊÑè§ ÀÒÂãµéWindows IP Configuration¡Ãкǹ¡ÒÃPrimary DNS Suffixsection contains the primary DNS suffix that is used for the computer object. Note that the individual network adapters may have different specific suffixes, however, the Network Name resource uses the primary DNS suffix.

Renaming the Network Name and its corresponding computer object

The process of renaming a VirtualServer that has an associated computer object is similar to renaming a standard Network Name resource, except the resource has to be offline to make the change. Take the Network Name resource offline, and then change the Parameters property to the new name. The Network Name resource will automatically contact Active Directory and change the computer object's name. For the rename operation to be successful, both the Network Name on the cluster and the computer name in the Active Directory must be changed. If both cannot be changed, the original name is rolled back, and the change is not completed. The Cluster service account will require the "Write all Properties" access right to make the change to the computer object. computer objects cannot be manually renamed in the Active Directory Computers and Users MMC.

Disabling Kerberos authentication

The Cluster service never deletes a computer object from Active Directory. Instead, the Cluster service disables it. To disable the computer object, click to clear the¡ÒÃà»Ô´ãªé§Ò¹¡ÒÃÃѺÃͧ¤ÇÒÁ¶Ù¡µéͧ KerberosµÑÇàÅ×Í¡ After the computer object is disabled, the Network Name resource does not come online until you either select theEnable Kerberos Authenticationoption again or manually delete the computer object from Active Directory.

DNS settings

¡Ãкǹ¡ÒÃDNS Registration Must Succeedoption on a Network Name resource helps to make sure that DNS is updated before the resource comes online. If you select this option, the DNS HOST (A) record for the VirtualServer must be registered or the Network Name Resource fails to come online. If the DNS server accepts dynamic updates but the record could not be updated, that is considered a failure. If the DNS server does not accept dynamic updates (older versions of DNS) or there are no DNS servers associated with the resource's associated network, the Network Name will still come online. àÁ×è͵éͧ¡ÒÃà»Ô´ãªé§Ò¹¹Ñé¹DNS Registration Must Succeedoption, follow these steps:

1. Start Cluster Administrator, right-click the Network Name resource, and then clickTake Offline.
   
   ËÁÒÂà˵Ø:Access to the VirtualServer by clients cannot now occur because the Network Name resource is offline.
2. Double-click the Network Name resource where you want to enable theDNS Registration Must Succeedoption, and then click the¾ÒÃÒÁÔàµÍÃìá·çº
3. ¤ÅÔ¡¡ÒÃDNS Registration Must SucceedµÑÇàÅ×Í¡ ¤ÅÔ¡µ¡Å§, right-click the Network Name resource, and then click¹Ó·Ò§Í͹äŹì. When the Network Name resource comes online, it will verify that it can register the VirtualServer with the DNS server.

ËÁÒÂà˵Ø:: The Network Name is registered in DNS under the Cluster service account. Make sure that the Cluster service account has correct permissions to register records in DNS or the registration will not work.

Status indicators

When you view the properties of a Network Name resource, three status indicators are available, NetBIOS Status, DNS Status, and Kerberos Status. To view these indicators:

1. àÃÔèÁµé¹¼Ùé´ÙáŢͧ¤ÅÑÊàµÍÃì
2. Double-click the Network Name resource, and then click the¾ÒÃÒÁÔàµÍÃìá·çº The three status indicators are listed in the middle of the¾ÒÃÒÁÔàµÍÃìá·çº

ÃÒ¡ÒõèÍ仹Õé͸ԺÒ¶֧ÊÔ觷ÕèáÊ´§¢Í§áµèÅеÑǺ觪ÕéʶҹРÁÕà»ÅÕè¹µÑǺ觪Õé·ÕèàËÅèÒ¹ÕéàÁ×èÍÁÒÍ͹äŹì ËÃ×Í¡ÒÃÍÍ¿äŹìª×èÍà¤Ã×Í¢èÒÂ

• netbios ʶҹÐ: Êзé͹ʶҹРNetBIOS The ¡Òú觪Õé¶Ö§¤ÇÒÁÊÓàÃç¨ËÃ×ÍÅéÁàËÅǢͧ¡ÒÃŧ·ÐàºÕ¹ª×èÍ NetBIOS ´éǵÑÇà»ÅÕè¹àÊé¹·Ò§à¤Ã×Í¢èÒÂÀÒÂã¹ ¤èÒà»ç¹ 0 ¨ÐÊÓàÃç¨ ÁԩйÑé¹ ¨ÐáÊ´§ÃËÑÊ¢éͼԴ¾ÅÒ´ ¹ÕèäÁèºè§ªÕéÇèÒ ÁÕ¡ÒÃŧ·ÐàºÕ¹ª×èÍ NetBIOS à«ÔÃì¿àÇÍÃì WINS ËÃ×Í DNS ·Õèà¡ÕèÂÇ¢éͧ àÁ×è͵éͧ´Ù¢éͤÇÒÁ¢Í§ÃËÑÊ¢éͼԴ¾ÅÒ´ ¾ÔÁ¾ìhelpmsg ÊØ·¸Ô% errorcode %·Õè¾ÃÍÁµì¤ÓÊÑè§ áÅéÇ¡´ ENTER
• ʶҹРdns: Êзé͹µÑǺ觪ÕéʶҹРDNS ä´é¶Ö§¤ÇÒÁÊÓàÃç¨ËÃ×ÍÅéÁàËÅǢͧª×èÍà¤Ã×Í¢èÒ·ÕèÁÕ¡ÒÃŧ·ÐàºÕ¹¡Ñºà«ÔÃì¿àÇÍÃì DNS A value of 0 is successful; otherwise it displays an error code. To view the text of the error code, typenet helpmsg %errorcode%at a command prompt, and then press ENTER.
• Kerberos Status: The Kerberos Status indicator displays a code that indicates if the creation or updating of the Computer Object was successful or not. A value of 0 is successful; otherwise it displays an error code. To view the text of the error code, typenet helpmsg %errorcode%·Õè¾ÃÍÁµì¤ÓÊÑè§ áÅéÇ¡´ ENTER

Seven parameters for the Network Name resource in Windows Server 2003 that are not included in earlier versions of Windows

The following parameters under the Network Name resource are used to support the features of the Network Name Resource in Windows Server 2003 that are not included in earlier versions of Windows. To view these Network Name resource parameters, typecluster res "network_name_resource" /priv·Õè¾ÃÍÁµì¤ÓÊÑè§ áÅéÇ¡´ ENTER The parameters are as follows:

• RequireDNS- TheRequireDNSparameter matches theDNS Registration Must Succeedoption in the user interface for the Network Name resource. It can have a value of 0 or 1:
  • 0 - Failed DNS registration does not prevent resource from coming online.
  • 1 - If the DNS server cannot be updated, the resource will not come online.
• RequireKerberos- TheRequireKerberosparameter matches the¡ÒÃà»Ô´ãªé§Ò¹¡ÒÃÃѺÃͧ¤ÇÒÁ¶Ù¡µéͧ Kerberosoption in the user interface for the Network Name resource. It can have a value of 0 or 1:
  • 0 - Kerberos Authentication is not enabled, and a computer object is not created for the Network Name resource.
  • 1 - Computer object is created and Kerberos Authentication is enabled.
• CreatingDC- TheCreatingDCparameter displays the domain controller that was used by the cluster server to create or to modify the VirtualServer computer object.CreatingDCalso displays the domain controller that was contacted to "hijack" the existing computer object if a computer object was pre-created by the domain administrator. This value is cleared when theRequireKerberosparameter is cleared. If kerberos was never enabled on the Network Name resource, you might see the following entry in the cluster.log file:
  Unable to read CreatingDC parameter, error=2
  You can ignore this entry. This does not indicate a problem because although you see the entry, the extry does not actually exist.
• ResourceData- TheResourceDatavalue contains the encrypted password. Access toResourceDatain the registry is limited to the local administrator, to the system administrator, and to the creator owner. If kerberos was never enabled on the Network Name resource, you might see the following entry in the cluster.log file:
  Unable to read ResourceData parameter, error=2
  You can ignore this entry. This does not indicate a problem because although you see the entry, the entry does not actually exist.
• StatusNetBIOS- This matches what is displayed in the user interface under the Network Name resource.
• StatusDNS- This matches what is displayed in the user interface under the Network Name resource.
• StatusKerberos- This matches what is displayed in the user interface under the Network Name resource.

Command-line options

Like most of administration tasks of a server cluster, you can enable the "DNS Registration Must Succeed" and "Enable Kerberos Authentication" features from a command prompt by using the Cluster.exe tool. Cluster.exe is installed by default, so to use it, issue the following commands at a command prompt (assuming you are running these commands from one of the cluster nodes).

àÁ×è͵éͧ¡ÒÃà»Ô´ãªé§Ò¹¹Ñé¹DNS Registration Must Succeedoption from the command prompt, type the following command:Set RequireDNS=0 to disable RequireDNS.

àÁ×è͵éͧ¡ÒÃà»Ô´ãªé§Ò¹¹Ñ鹡ÒÃà»Ô´ãªé§Ò¹¡ÒÃÃѺÃͧ¤ÇÒÁ¶Ù¡µéͧ Kerberosoption from the command prompt, type the following command:Set RequireKerberos=0 to disable RequireKerberos.

To view the Status indicators from Cluster.exe, type the following command:For more information about Cluster.exe and other uses, see "Help and Support," and then search for Cluster.exe.

The File Replication service and server clusters

The File Replication service (FRS) does not replicate with a file share that is on a server cluster under a virtual server's computer object. The FRS service looks for subscription information only under the node's computer object. The FRS service does not scan the virtual server's computer object. Distributed File System (DFS) uses the FRS to replicate data among multiple servers when a replication policy is enabled. If the DFS link with the replication policy is a virtual server, data is not replicated with any other partner. You may have to use another method to replicate the data. For example, you may have to use a file copy script.

¡ÒÃá¡é䢻ѭËÒ

For information about troubleshooting the creation and manipulation of computer objects by the Cluster service account, see the following article in the Microsoft Knowledge Base: