Connecting to Failover cluster Access denied

Question

_{Monday, November 5, 2018 5:47 PM}

I use a domain user which has local administrators right in the computer, however when connect to the failover cluster got the above error.

after giving the domain user "Domain Admin", the user can connect to cluster successfully.

If I don't want to give Domain Admin to the user, what else permission is should grant to this user so that it can access the cluster ?

it is using windows 2016

All replies (7)

_{Tuesday, November 6, 2018 1:05 PM ✅Answered}

Hi,

Yes, I know. I mean that , we also must have this domain account be member of Account Operators or Domain Admins, if you don't want it membership in Domain Admins Group, we can try the Account Operators Group in AD as below.

Reference link:

/en-us/previous-versions/orphan-topics/ws.10/dd728026(v=ws.10)

Best regards,

Michael

Please remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected]

_{Thursday, November 8, 2018 2:13 AM ✅Answered}

You're welcome. I'm very glad that the information is helpful to you. 

Thanks for your sharing. 😊

Best regards,

Michael

Please remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected]

_{Monday, November 5, 2018 6:05 PM}

Is the user is member of the local Administrators group of all cluster nodes ?

This posting is provided AS IS without warranty of any kind

_{Tuesday, November 6, 2018 3:41 AM}

Hi,

I understand your current desired request. We can refer to this docs (/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731002(v=ws.10)) and roll down to the section "**Steps for configuring the account for the person who installs the cluster **", 

The minimum group membership required to complete the following procedure depends on whether you are creating the domain account and assigning it the required permissions in the domain, or whether you are only placing the account (created by someone else) into the local Administrators group on the servers that will be nodes in the failover cluster. If the former, membership in Account Operators or Domain Admins, or equivalent, is the minimum required to complete this procedure. If the latter, membership in the local Administrators group on the servers that will be nodes in the failover cluster, or equivalent, is all that is required. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477 .

So, we can try to add the cluster-operator account to Account Operators in the ADUC console to see if it can work.

Highly appreciate your effort and time. If you have any question or concern, please feel free to let me know.

Best regards,

Michael

Please remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected]

_{Tuesday, November 6, 2018 8:18 AM}

the domain account is already in the local administrators

_{Tuesday, November 6, 2018 2:57 PM}

thanks ~ it works

_{Wednesday, April 22, 2020 5:11 PM}

We have run into this similar Error . I discovered that Quorum server - did not have Privileges - as run the Power shell command. Run Test- cluster any of the Nodes.

Test-Cluster : You do not have administrative privileges on the server  ' Quorum server'

Once We add that on Quorum server - I was able to see.

Thank you,

Venkata Peeta