Access Denied trying to connect to a cluster with Failover Cluster Manager after upgrading to 2019

Question

Hi,

I have a utility server that was running Server 2016. I have another utility server that's on 2019. Both had no issues connecting ot any of the clusters we have in our environment via Failover Cluster Manager.

Yesterday, I upgraded the 2016 server to 2019. After doing so, everything on the server seemed fine until I tried to connect to a cluster. Now, when I open FCM and try to connect to ANY of our clusters, I get an Access Denied error

If I try to do a Validate on the cluster, it tells me I don't have admin rights.

What might have happened during the 2016 to 2019 upgrade that would have broken this? If I log onto the server that was already running 2019, I can connect to all of our clusters without any problems, so it's not a 2019 compatibility issue. It's only the server that was upgraded from 2016 to 2019 that is giving the trouble. I can access it from other utility boxes, so it's not a problem with my ID.

I'm at a loss as to what I can check to get this fixed before I just revert back to 2016...

Thanks.

Answer 1

Hi Mike Boehm,

Thank you for posting in Q&A forum.

I suspect that the inconsistent system patch levels of your cluster nodes caused the cluster nodes to fail to join the cluster. I suggest that you open the event log of the node to see if there is an error of 10036.

The June 2022 patch (2022.06) modified the configuration settings of DCOM (Hardening changes enabled by default). The Distributed Component Object Model (DCOM) remote protocol is a protocol that uses remote procedure calls (RPC) to expose application objects. For detailed information, you can refer to the following documents:

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

If the system detects that a DCOM client application is trying to activate a DCOM server using an authentication level lower than RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, a DCOM 10036 event may be logged, and the cluster may be unable to connect to the failover cluster or add nodes (this is because the Failover Cluster Manager belongs to MMC, and basically MMC is highly dependent on COM/DCOM and WMI technologies, so it will be affected).I recommend that you upgrade all nodes in the cluster to the latest patch or to the same level.

Best regards

Zunhui

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

I will check that. When I did the upgrade, I selected YES to the question asking if it should go get Updates during the upgrade process. I guess that option doesn't actually work? I just assumed the server would be up to date when it was done.

Thanks.

Answer 3

The Utility server that I upgraded from 2016 to 2019 did not install Windows Updates as part of the update process. Once I manually got it updated, it was able to connect to the cluster without any problems.