How to recover a deleted computer object that supports a Network Name resource in a Windows Server 2008 or Windows Server 2008 R2 failover cluster

This article describes how to recover a deleted computer object that supports a Network Name resource in a Windows Server 2008 or Windows Server 2008 R2 failover cluster.

By default, the new security model in Windows Server 2008 or Windows Server 2008 R2 failover clustering includes Kerberos authentication. To create this security model, every Client Access Point (CAP) that is created in a Windows Server 2008 or Windows Server 2008 R2 failover cluster contains a Network Name resource. The Network Name resource has a corresponding Computer Account that is created in the Active Directory directory service when the resource is online for the first time.

By default, the Computer Account is created in the Computers container. However, the Computer Account can be relocated to another organizational unit (OU). The Computer Account can also be pre-staged in an OU before the CAP is created. If these Computer Accounts are deleted from Active Directory, availability of the Network Name resource will be reduced.

The computer accounts that are created in Active Directory represent the Network Name resources in a failover cluster. These accounts have the following distinct types:

• The computer account that represents the name of the cluster is called the Cluster Name Object (CNO). This account is the primary security context for a cluster.
• Other computer accounts that belong to Network Name resources in the same cluster are called Virtual Computer Objects (VCOs). These accounts are created by the CNO.

If either of these accounts is deleted from Active Directory, the next time that the Network Name tries to go online, the Network Name fails, and the following error message is logged in the System log:
and the following messages are logged in the cluster log:



Note: status 80072030 = There is no such object on the server

However, problems will occur even before the Network Name resource is cycled offline and online. For example, a user or a highly available application may be unable to access resources when a security token that represents the cluster computer object in Active Directory cannot be obtained.

To recover from the deletion of a Computer Object that is associated with a cluster Network Name resource is different for a CNO than recovering from the deletion of a Computer Object for a VCO.

To recover a deleted computer object that corresponds to the CNO, follow these steps:

1. Coordinate with a domain administrator to first recover the deleted Computer Object from the Deleted Objects container in Active Directory.
2. Verify that the Computer Object has been restored to the correct location, and then enable the account.
3. Force domain replication to occur, or wait for the configured replication interval.
4. In the Failover Cluster Management Microsoft Management Console (MMC) snap-in, right-click the failed network name that corresponds to the cluster name, point to More actions, and then click Repair Active Directory Object.

Note The user who follows these steps in the Failover Cluster Management MMC snap-in must also have the "Reset Passwords" permission in the domain.

To recover a deleted computer object that corresponds to a VCO, follow these steps:

1. Coordinate with a domain administrator to first recover the deleted computer object from the Deleted Objects container in Active Directory.
2. Verify that the computer object has been restored to the correct location, and then enable the account.
3. View the security settings for the computer object, and then verify that the CNO still has permissions to the object.
4. Force domain replication, or wait for the configured replication interval.
5. In the Failover Cluster Management MMC snap-in, right-click the failed Network Name resource, and then click Bring this resource online.

If a deleted computer object no longer exists in the Deleted Objects container, an Active Directory authoritative restore action must be executed by using a system state backup that contains the deleted object or objects.

For more information, visit the following Microsoft Web sites:

http://blogs.technet.com/b/askcore/archive/2009/04/27/recovering-a-deleted-cluster-name-object-cno-in-a-windows-server-2008-failover-cluster.aspx