Important - This hotfix download prevents the issues that are described in the "Symptoms" section. However, if you are already experiencing these issues, you need to reset the password on the affected name resource or on the cluster name as described in the Post-installation instructions.
Issue 1You have a file share resource that is hosted on a Windows Server 2012-based failover cluster, and you try to access the file share from a Windows XP-based or Windows Server 2003-based computer. In this scenario, you cannot access the resource, and you receive the following error message:
At the same time, the following Error event is logged in the event log of the Windows XP-based or Windows Server 2003-based computer:
Event Source: Kerberos
Event Category: None
Event ID: 4
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server <cluster-file-server$>. The target name used was cifs/cluster-file-server.domain.com.
This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (domain.COM), and the client realm. Please contact your system administrator.
- The file share resource can be accessed if you connect to it by using the IP address.
- You may also see "SMB:KrbError: KRB_AP_ERR_MODIFIED (41) R; Session Setup Andx, Krb5Error (0x300)" for the SMB Session Setup server response in a network trace.
- You do not see this behavior with Windows 7 and later client computers unless you force them to use rc4-hmac.
Issue 2When you attempt to bring a network name resource online in a Windows Server 2012-based failover cluster, the attempt fails. Additionally, the following events are logged in the System log:
Cluster network name resource 'Cluster Name' encountered an error enabling the network name on this node. The reason for the failure was: 'Unable to obtain a logon token'. The error code was '1326'. You may take the network name resource offline and online again to retry.
Event ID 1196
Cluster network name resource 'Cluster Name' failed registration of one or more associated DNS name(s) for the following reason: The handle is invalid. Ensure that the network adapters associated with dependent IP address resources are configured with at least one accessible DNS server.
Also, you may see the following in the cluster log:
WARN [RES] Network Name: [NNLIB] LogonUserEx fails for user E0117-C1$: 1326 (useSecondaryPassword: 0)
WARN [RES] Network Name: [NNLIB] LogonUserEx fails for user E0117-C1$: 1326 (useSecondaryPassword: 1)
WARN [RES] Network Name <Cluster Name>: AccountAD: Slow operation has exception ERROR_INVALID_HANDLE(6)' because of '::ImpersonateLoggedOnUser( GetToken() )'
ERR [RES] Network Name <Cluster Name>: Online thread Failed: ERROR_SUCCESS(0)' because of 'Initializing netname configuration for ‘Cluster Name’ failed with error 6.'
INFO [RES] Network Name <Cluster Name>: All resources offline. Cleaning up.
ERR [RHS] Online for resource Cluster Name failed. Error 6 -> The Handle is invalid.
Issue 3The live migration of virtual machines between Windows Server 2012 hosts fail. When this occurs, the following event may be logged:
Live migration of 'VM name' failed. Virtual machine migration operation for 'VM name' failed at migration source 'Node name'
The Virtual Machine Management Service failed to establish a connection for a Virtual Machine migration with host 'Node name': The logon attempt failed (0x8009030C).
The Virtual Machine Management Service failed to authenticate the connection for a Virtual Machine migration at the source host: The logon attempt failed (0x8009030C).
For more information about how to obtain update rollup 2889784, click the following article number to view the article in the Microsoft Knowledge Base:
This hotfix is also available at Microsoft Update Catalog.
Microsoft also recommends that you upgrade the domain functional level for the Active Directory domain that the Windows Server 2012 Failover Cluster is connected to from Windows Server 2003 to a later version of Windows Server.
Hotfix informationA supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.
If the hotfix is available for download, there is a "Hotfix Download Available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft website: Note The "Hotfix Download Available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
PrerequisitesTo apply this hotfix, you must be running Windows Server 2012.
Registry informationTo use the hotfix in this package, you do not have to make any changes to the registry.
Restart requirementYou must restart the computer after you apply this hotfix.
Post-installation instructionsThis hotfix prevents the issues that are described in the "Symptoms" section. However, if you are already experiencing these issues, you need to reset the password on the affected name resource. But if it still does not work, try to reset the password on the cluster name.
NoteYou must be logged on with a user account that has rights to administer the cluster and to reset passwords in the domain in order to perform the following steps.
To reset the password on the affected name resource or on the cluster name, perform the following steps:
- From Failover Cluster Manager, locate the name resource.
- Right-click on the resource, and click Properties.
- On the Policies tab, select If resource fails, do not restart, and then click OK.
- Right-click on the resource, click More Actions, and then click Simulate Failure.
- When the name resource shows "Failed," right-click on the resource, click More Actions, and then click Repair.
- After the name resource is online, right-click on the resource, and then click Properties.
- On the Policies tab, select If resource fails, attempt restart on current node, and then click OK.
Hotfix replacement informationThis hotfix does not replace a previously released hotfix.
Article ID: 2838043 - Last Review: May 19, 2015 - Revision: 1