Pre-Staging Windows Server Failover Cluster Active Directory Objects

Overview

This document will outline, on a high level, the process to pre-staged new Windows Server Failover Cluster [WSFC] Active Directory objects.  For detailed steps on creating these objects please refer to this document by Microsoft.

Organizational Unit

All Active Directory objects associated to the WSFC should be added to the appropriate Organizational Unit [OU].  This is primarily handled by your Windows/Infrastructure team.

Cluster Name Object

The Cluster Name Object [CNO] is the computer object which owns all other computer objects associated to the WSFC.

1. Run dsa.msc from the Windows command prompt.  This will bring up the Active Directory Users and Computers UI.
   
   
2. Go to the appropriate OU and create the new computer object [CNO] under it.
   NOTE:  Put in an appropriate description to help identify the purpose of this new object
   e.g.
   MYTESTCNO1$
   
   
3. Disable the new CNO object.
   NOTE:  This is required to as the WSFC wizard will need to confirm the computer object in question is not being used with the cluster you will be creating.
   

Virtual Computer Object

All services installed on a WSFC [e.g MSDTC, SQL Server FCI, Availability Group Listener, etc] need to have a Virtual Computer Object [VCO] created and the appropriate permissions added so the WSFC will function properly.

1. Run dsa.msc from the Windows command prompt.  This will bring up the Active Directory Users and Computers UI.
   
   
2. Under the View menu choose Advanced Features.
   
   
3. Go to the appropriate OU and create the new computer object [VCO] under it.
   NOTE:  Put in an appropriate description to help identify the purpose of this new object
   e.g.
   MYTESTMSDTC01
   
   
4. Right click on the new object created and click Properties.
   
   
5. On the Security tab click Add.  Click Object Types and make sure that Computers is selected then click Ok.
   
   
6. Type the name of the CNO and click Ok.  Select the CNO and under Permissions click Allow for Full Control permissions.
   
   
7. Repeat as necessary for all other VCO objects.
   

Active Directory Integrated DNS

In environment where DNS is controlled by Active Directory permissions must be granted for the CNO to be able to update those records.  NOTE:  This is typically a 1 time operation.

1. Once all VCO objects have been created, create a DNS entry for the VCO that require an IP address.  NOTE:  With objects that span multiple subnets they will require 2 IP address to be pre-staged.
   e.g.
   WSFC Cluster Name

WSFC Node Name

SQL Server FCI Hostname

Availability Group Listener

2. Once the DNS entries have been created give the CNO Full Control on the new entries.

SQL Service Account

All SQL services configured on a WSFC [e.g SQL Server FCI, Availability Group Listener, etc] need to run under the credentials of a SQL Service Account.  This account will have the permissions, through the CNO, to create SQL Server FCI and/or Availability Group Listeners on the WSFC.

1. Run dsa.msc from the Windows command prompt.  This will bring up the Active Directory Users and Computers UI.
   
   
2. Under the View menu choose Advanced Features.
   
   
3. Go to the appropriate OU and create the new user account under it.
   NOTE:  Put in an appropriate description to help identify the purpose of this new object
   e.g.
   S-MYTESTSQLSVC01
   
   
4. Right click on the new user account created and click Properties.
   
   
5. On the Security tab click Add.  Click Object Types and make sure that Computers is selected then click Ok.
   
   
6. Type the name of the CNO and click Ok.  Select the CNO and under Permissions click Allow for Full Control permissions.
   
   
7. Add the service account to the appropriate NT security group for SQL Server.
   e.g.
   G-SQLServiceAccounts
   

Service Principal Name [SPN]

For Kerberos authentication to work correctly within SQL Server, the SQL Service Account and CNO require rights to read and write servicePrincipalName in Active Directory.
CNO:

1. Run adsiedit.msc from the Windows command prompt.  This will bring up the Active Directory Service Interfaces Editor UI.
   
   
2. Go to the appropriate OU and search for the CNO.
   
   
3. Under the Security tab choose Advanced.
   
   
4. Locate the SELF name and click Edit.
   
   
5. Under the Object tab verify that the Validate write to service principal name is checked for Allow.
   
   
6. Under the Properties tab verify that the Read servicePrincipalName and Write servicePrincipalName are checked for Allow.
   
   
7. Click OK to accept the changes, if necessary.
   
   

SQL Service Account:

1. Run adsiedit.msc from the Windows command prompt.  This will bring up the Active Directory Service Interfaces Editor UI.
   
   
2. Go to the appropriate OU and search for the SQL Service Account.
   
   
3. Under the Security tab choose Advanced.
   
   
4. Select Add, type in SELF and click OK.  In the Apply to: field selected the SQL Service Account.
   
   
5. Under the Properties tab check the Read servicePrincipalName and Write servicePrincipalName for Allow.
   
   
6. Click OK to accept the changes.