pdc go down / 2008 r2 failover cluster go down

[guest]

I have 2008 R2 failover cluster. There are also two 2008 R2 DC's in VM to support that failover cluster. One site, both DC are GC, but all FSMO roles are on one DC. When I shutdown PDC complete failover cluster goes down. How that come ? Shouldn't failover cluster start to using other one DC for authentication ?

[guest]

It seems that you put the DC and GC VMs on the Hyper-V Failover Cluster and then add the cluster nodes to the DC. If so, I would like to let you know that it is not recommended.



If you are in a test environment, you can either put the DC on a physical computer or a VM on another Hyper-V computer who is not a part of the cluster. If you are in a production environment, Microsoft recommends you locate critical server roles on domain controllers that are installed directly on physical hardware. These include Global Catalog servers, Domain Name System (DNS) servers, Flexible Single Master Operations (FSMO) roles and replication bridgeheads.

[guest]

No, failover cluster nodes are not DC's, and DC's are not in failover cluster, but they exist as standalone Hyper-V VM on each node. However DC's vhd's are on CSV. I will move them today to separate LUN because nodes don't have local disk.

[guest]

Well, there are some troubles because of missing updates on failover cluster nodes, wrong configured network for LM and CSV (unbinded MS Client and File & Print Sharing). All that was corrected.

Yesterday I have to add some VLAN's. First, I've pause node and shutdown DC - PDC which was running in Hyper-V on that node.

After that I've must to remove from Hyper-V virtual network manager all assigned networks because I did not have VLAN tab on network card properties.

After that, two other nodes lost their connectivity to CSV, when viewing other two nodes from third node it claim's that I've should start claster. But some HA VM's working and other goes offline.

Two other DC's where available but it seems that failover cluster only trying to find PDC which was shutdown temporarily

[guest]

Just find that latest intel driver / proset don't have VLAN tab on network card configure properties but is possible to use prosetcl.exe from command line to remove or add VLAN on network interface without need to unbind from hyper-v virtual network manager.

[guest]

I disagree with your conclusion. I am sure if you put Wireshark and perform a network trace you will come to know the culprit. Cluster has nothing to do with PDC technically PDC is only required for changing passwords and keeping time into the domain. I also recommend you split the FSMO roles domain & forest wise onto DC. No point in keeping all the roles onto one box doesnt help.

I Hope network adapter priority is set correctly "Public on the top" and "Internal at the bottom". Also the cluster network adapter priority is also set properly.(Internal on top and public at the bottom).

Let me know, the network traces outcome it will help in resolving you issue.

[guest]

Sorry to ressurect this thread; I found it while searching to see if anybody had this issue.

I had almost exactly the same thing happen to me a few years ago on a 2008 cluster & domain. I had to shut down the AD server with the FMSO roles due to needing to physically relocate it (it was going to a different rack). I got sidetracked by another unrelated issue , and then about four hours later, the four node hyper-v failover cluster that was in the domain did a graceful shutdown, even though there was another GC available in the network. Manually starting the cluster again didn't work, the cluster would not start until I brought back the AD server with the FMSO roles. Since then I have been religious about keeping maintenance windows on servers holding FMSO roles to an absolute minimum, and/or transferring FMSO roles to other GCs before periods of extended planned downtime. I never had time to research the issue, and I wanted to find out if it still existed.

My pet theory is that it is PDC related. Perhaps the cluster account computer account (not sure if clustering still needs a computer account in AD) needs to have its password changed at regular intervals, and if this can't be done because there is no PDC, the cluster shuts down?

Anyway, I also tried to think of a way of automating a way out of this. The trouble is, that if you can't plan the transfer of FMSO roles, they have to be seized, and if you do that, you can't bring the server back without risk of major problems. So doing automated seizure in some way would be extremely risky.

Hopefully this is something that gets addressed in the upcoming release of server - automated failover of all aspects of AD, because at the moment it seems that failover clustering has a dependency on something in AD that is a single point of failure, which is difficult if not impossible to eliminate.

I'd certainly appreciate informed comments on this from anyone with intricate knowledge of failover clustering's relationship with AD...