Monday 3 March 2014

How to disable Cluster Aware Updating (CAU)

Have you ever wanted to disable Cluster Aware Updating perhaps just for a while or even permanently? The problem is that you might get recurring an Kerberos Security error in Server Manager on one of your cluster nodes.


The error message below will appear in the system log:


"The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server "server name". The target name used was HTTP/server_name.domain.local. This indicates that the server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target server is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain "domain.local" is different from the client domain "domain.local" check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server."

The solution is quite simple but perhaps not obvious even though it's stated in the error message. What you need to do is to add two SPN's to your CAU account.

  1. Open an elevated command prompt
  2. setspn -S http/CAU-account-name CAU-account-name
  3. setspn -S http/CAU-fqdn-account-name CAU-account-name

7 comments:

  1. Hi Kim! I have exactly the same error, but I have some doubts:

    What is right sintax of the command

    my servers that are clustered are named r52 and r53 and the name of the cluster is com-dag
    where should I run these commands? And I did not understand what is CAU account, where can I identify that?
    Thank you very much!

    ReplyDelete
  2. Hi!

    You can run the command on any server in your domain but the account you are using must be a member of Domain Admins or Enterprise Admins or have been assigned the appropriate rights to perform the action. If you have not pre-staged the CAU account then you should have an account similar to "CAU" in your Active Directory. Search your Active Directory for a computer account and specify "CAU*" in the search and you will find the account.

    Good luck!

    Regards
    Kim

    ReplyDelete
  3. Do you need to restart the cluster to pick up this change?

    ReplyDelete
  4. Hi Kim,
    Could you specify how to find CAU-fqdn-account-name and CAU-account-name?

    ReplyDelete
  5. This comment has been removed by the author.

    ReplyDelete
  6. Hi Samapanda,

    I'm sorry for my late reply. I've been on vacation. Have a look in the OU in your Active Directory where your cluster object resides. By default the new CAU object will be created where the cluster object resides. If I'm not mistaking it should be something like CAU"random characters". It normally stands out from the crowd so it should be easy to find.

    Regards
    Kim

    ReplyDelete