Important - This hotfix download prevents the issues that are described in the "Symptoms" section. However, if you are already experiencing these issues, you need to reset the password on the affected name resource or on the cluster name as described in the Post-installation instructions.
Symptoms
Issue 1
You have a file share resource that is hosted on a Windows Server 2012-based failover cluster, and you try to access the file share from a Windows XP-based or Windows Server 2003-based computer. In this scenario, you cannot access the resource, and you receive the following error message:
<path> is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions. Logon Failure: The target account name is incorrect.
At the same time, the following Error event is logged in the event log of the Windows XP-based or Windows Server 2003-based computer:
Event Type: ErrorEvent Source: KerberosEvent Category: NoneEvent ID: 4Description:The kerberos client received a KRB_AP_ERR_MODIFIED error from the server <cluster-file-server$>. The target name used was cifs/cluster-file-server.domain.com. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (domain.COM), and the client realm. Please contact your system administrator.
Notes
-
The file share resource can be accessed if you connect to it by using the IP address.
-
You may also see "SMB:KrbError: KRB_AP_ERR_MODIFIED (41) R; Session Setup Andx, Krb5Error (0x300)" for the SMB Session Setup server response in a network trace.
-
You do not see this behavior with Windows 7 and later client computers unless you force them to use rc4-hmac.
Issue 2
When you attempt to bring a network name resource online in a Windows Server 2012-based failover cluster, the attempt fails. Additionally, the following events are logged in the System log:
Event ID 1228Cluster network name resource 'Cluster Name' encountered an error enabling the network name on this node. The reason for the failure was: 'Unable to obtain a logon token'. The error code was '1326'. You may take the network name resource offline and online again to retry.Event ID 1196Cluster network name resource 'Cluster Name' failed registration of one or more associated DNS name(s) for the following reason: The handle is invalid. Ensure that the network adapters associated with dependent IP address resources are configured with at least one accessible DNS server.
Also, you may see the following in the cluster log:
INFO [RES] Network Name: [NNLIB] LsaCallAuthenticationPackage success with a request of size 82, result size 0 (status: 0, subStatus: 0)WARN [RES] Network Name: [NNLIB] LogonUserEx fails for user E0117-C1$: 1326 (useSecondaryPassword: 0)WARN [RES] Network Name: [NNLIB] LogonUserEx fails for user E0117-C1$: 1326 (useSecondaryPassword: 1) WARN [RES] Network Name <Cluster Name>: AccountAD: Slow operation has exception ERROR_INVALID_HANDLE(6)' because of '::ImpersonateLoggedOnUser( GetToken() )'ERR [RES] Network Name <Cluster Name>: Online thread Failed: ERROR_SUCCESS(0)' because of 'Initializing netname configuration for ‘Cluster Name’ failed with error 6.'INFO [RES] Network Name <Cluster Name>: All resources offline. Cleaning up.ERR [RHS] Online for resource Cluster Name failed. Error 6 -> The Handle is invalid.
Issue 3
The live migration of virtual machines between Windows Server 2012 hosts fail. When this occurs, the following event may be logged:
Event ID 21502Live migration of 'VM name' failed. Virtual machine migration operation for 'VM name' failed at migration source 'Node name' The Virtual Machine Management Service failed to establish a connection for a Virtual Machine migration with host 'Node name': The logon attempt failed (0x8009030C).The Virtual Machine Management Service failed to authenticate the connection for a Virtual Machine migration at the source host: The logon attempt failed (0x8009030C).
Cause
These issues occur when running a Windows Server 2012 Failover Cluster which is a member of a Active Directory domain which has a Domain Functional Level of Windows Server 2003. This is a result of the rc4-hmac keys on the Domain Controller and the cluster side for the virtual computer object (VCO) are different. The ticket decryption fails when the ticket is encrypted by using the rc4-hmac encryption. Additionally, the cluster becomes unavailable for any computer that uses the rc4-hmac keys.
Resolution
To resolve this issue, install update rollup 2889784, or install the hotfix that is described in this article. For more information about how to obtain update rollup 2889784, click the following article number to view the article in the Microsoft Knowledge Base:
2889784 Windows RT, Windows 8, and Windows Server 2012 update rollup: November 2013 This hotfix is also available at Microsoft Update Catalog.Microsoft also recommends that you upgrade the domain functional level for the Active Directory domain that the Windows Server 2012 Failover Cluster is connected to from Windows Server 2003 to a later version of Windows Server.
Hotfix information
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.If the hotfix is available for download, there is a "Hotfix Download Available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix. Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft website:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix Download Available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
Prerequisites
To apply this hotfix, you must be running Windows Server 2012.
Registry information
To use the hotfix in this package, you do not have to make any changes to the registry.
Restart requirement
You must restart the computer after you apply this hotfix.
Post-installation instructions
This hotfix prevents the issues that are described in the "Symptoms" section. However, if you are already experiencing these issues, you need to reset the password on the affected name resource. But if it still does not work, try to reset the password on the cluster name.NoteYou must be logged on with a user account that has rights to administer the cluster and to reset passwords in the domain in order to perform the following steps.To reset the password on the affected name resource or on the cluster name, perform the following steps:
-
From Failover Cluster Manager, locate the name resource.
-
Right-click on the resource, and click Properties.
-
On the Policies tab, select If resource fails, do not restart, and then click OK.
-
Right-click on the resource, click More Actions, and then click Simulate Failure.
-
When the name resource shows "Failed," right-click on the resource, click More Actions, and then click Repair.
-
After the name resource is online, right-click on the resource, and then click Properties.
-
On the Policies tab, select If resource fails, attempt restart on current node, and then click OK.
Hotfix replacement information
This hotfix does not replace a previously released hotfix.
The global version of this hotfix installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.
Windows Server 2012 file information notesImportant Windows 8 hotfixes and Windows Server 2012 hotfixes are included in the same packages. However, only "Windows 8" is listed on the Hotfix Request page. To request the hotfix package that applies to one or both operating systems, select the hotfix that is listed under "Windows 8" on the page. Always refer to the "Applies To" section in articles to determine the actual operating system that each hotfix applies to.
-
The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
Version
Product
Milestone
Service branch
6.2.920 0.16 xxx
Windows Server 2012
RTM
GDR
6.2.920 0.20 xxx
Windows Server 2012
RTM
LDR
-
GDR service branches contain only those fixes that are widely released to address widespread, extremely important issues. LDR service branches contain hotfixes in addition to widely released fixes.
-
The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows Server 2012" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are extremely important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.
For all supported x64-based versions of Windows Server 2012
|
File name |
File version |
File size |
Date |
Time |
Platform |
|---|---|---|---|---|---|
|
Failoverclusters.objectmodel.dll |
6.2.9200.16703 |
805,376 |
30-Aug-2013 |
06:11 |
x64 |
|
Clusres.dll |
6.2.9200.16703 |
2,456,064 |
30-Aug-2013 |
05:18 |
x64 |
|
Clusapi.dll |
6.2.9200.16703 |
374,784 |
30-Aug-2013 |
05:18 |
x64 |
|
Resutils.dll |
6.2.9200.16703 |
626,688 |
30-Aug-2013 |
05:19 |
x64 |
|
Clusapi.dll |
6.2.9200.16703 |
302,080 |
29-Aug-2013 |
23:47 |
x86 |
|
Resutils.dll |
6.2.9200.16703 |
488,960 |
29-Aug-2013 |
23:48 |
x86 |
|
Clusapi.dll |
6.2.9200.20711 |
372,224 |
09-May-2013 |
00:29 |
x64 |
|
Clusres.dll |
6.2.9200.20711 |
2,463,232 |
09-May-2013 |
00:29 |
x64 |
|
Failoverclusters.objectmodel.dll |
6.2.9200.20711 |
805,376 |
09-May-2013 |
03:15 |
x64 |
|
Resutils.dll |
6.2.9200.20711 |
626,688 |
09-May-2013 |
00:30 |
x64 |
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More Information
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
Additional file information for Windows Server 2012
Additional files for all supported x64-based versions of Windows Server 2012
|
File name |
File version |
File size |
Date |
Time |
Platform |
|---|---|---|---|---|---|
|
Amd64_14947166e5fc6246e345777582704cf0_31bf3856ad364e35_6.2.9200.16703_none_d30dc128f99df9e1.manifest |
Not applicable |
1,076 |
30-Aug-2013 |
12:56 |
Not applicable |
|
Amd64_21c45ccc196e81f957e3a95676653170_31bf3856ad364e35_6.2.9200.16703_none_4c7a02f5939697bc.manifest |
Not applicable |
719 |
30-Aug-2013 |
12:56 |
Not applicable |
|
Amd64_50393e7caa4138610ef317a7dfce18cf_31bf3856ad364e35_6.2.9200.16703_none_e2b6bb12dba82457.manifest |
Not applicable |
718 |
30-Aug-2013 |
12:56 |
Not applicable |
|
Amd64_d64fe8ea3141b80fc9455bfb61ccd7ab_31bf3856ad364e35_6.2.9200.16703_none_722107ca7154442e.manifest |
Not applicable |
715 |
30-Aug-2013 |
12:56 |
Not applicable |
|
Amd64_microsoft-windows-f..cluster-objectmodel_31bf3856ad364e35_6.2.9200.16703_none_e903ebe1a75b0655.manifest |
Not applicable |
3,186 |
30-Aug-2013 |
06:24 |
Not applicable |
|
Amd64_microsoft-windows-f..overcluster-clusres_31bf3856ad364e35_6.2.9200.16703_none_19f9cd3e267f7abc.manifest |
Not applicable |
2,732 |
30-Aug-2013 |
06:24 |
Not applicable |
|
Amd64_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_6.2.9200.16703_none_ea66b67ec1e3cde7.manifest |
Not applicable |
3,269 |
30-Aug-2013 |
06:24 |
Not applicable |
|
X86_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_6.2.9200.16703_none_8e481afb09865cb1.manifest |
Not applicable |
3,265 |
30-Aug-2013 |
01:08 |
Not applicable |
|
Update.mum |
Not applicable |
3,339 |
30-Aug-2013 |
12:56 |
Not applicable |
|
Amd64_22959da6f77875e22c189aef602ac593_31bf3856ad364e35_6.2.9200.20711_none_7b6ea888e461d78e.manifest |
Not applicable |
1,076 |
09-May-2013 |
14:15 |
Not applicable |
|
Amd64_240ba0ace4c2c8b9c8745edd06482551_31bf3856ad364e35_6.2.9200.20711_none_271156e49f32068b.manifest |
Not applicable |
719 |
09-May-2013 |
14:15 |
Not applicable |
|
Amd64_7726f2098d2a44f4da03ecdb96d859b4_31bf3856ad364e35_6.2.9200.20711_none_eb6ac394e840a8da.manifest |
Not applicable |
715 |
09-May-2013 |
14:15 |
Not applicable |
|
Amd64_ba12a7bd45ebe55651873ea028d8ecf5_31bf3856ad364e35_6.2.9200.20711_none_72148c0b9ebe8511.manifest |
Not applicable |
718 |
09-May-2013 |
14:15 |
Not applicable |
|
Amd64_microsoft-windows-f..cluster-objectmodel_31bf3856ad364e35_6.2.9200.20711_none_e980b646c082923b.manifest |
Not applicable |
3,186 |
09-May-2013 |
03:25 |
Not applicable |
|
Amd64_microsoft-windows-f..overcluster-clusres_31bf3856ad364e35_6.2.9200.20711_none_1a7697a33fa706a2.manifest |
Not applicable |
2,732 |
09-May-2013 |
03:25 |
Not applicable |
|
Amd64_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_6.2.9200.20711_none_eae380e3db0b59cd.manifest |
Not applicable |
3,269 |
09-May-2013 |
03:25 |
Not applicable |
