Availability group listener permissions

Question

Availability group listener permissions

as_1234

SSCrazy

Points: 2864
More actions
September 7, 2017 at 6:25 am

#402467

All,
I'm trying to add the first listener to a new AG using SSMS.
I'm using the name bi-sql2016-agl
The error I get is that "the WSFC cluster couldn't bring the network name resource with DNS name 'BI-SQL2016-AGL' online. The DNS name may have been taken or have a conflict or the cluster may not be running or maybe inaccessible."
I've shortened the message slightly but the important info is there.
The cluster is online and the cluster logs show exactly the same error.
The DNS name doesn't exist and neither does the IP.
The IP comes online for a few seconds before the error shows and then goes offline again.
I would have thought the most likely issue was an AD permission issue but I created the WSFC and AG group using the same credentials.
Did I miss something obviously like using an invalid listener name? The documentation says the maximum for SSMS is 15 characters and this is 14?
Thanks

Viewing 6 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic. Login to reply

Perry Whittle SSC Guru Points: 234013 More actions · Answer 1

as1981 - Thursday, September 7, 2017 6:25 AM
All,
I'm trying to add the first listener to a new AG using SSMS.
I'm using the name bi-sql2016-agl
The error I get is that "the WSFC cluster couldn't bring the network name resource with DNS name 'BI-SQL2016-AGL' online. The DNS name may have been taken or have a conflict or the cluster may not be running or maybe inaccessible."
I've shortened the message slightly but the important info is there.
The cluster is online and the cluster logs show exactly the same error.
The DNS name doesn't exist and neither does the IP.
The IP comes online for a few seconds before the error shows and then goes offline again.
I would have thought the most likely issue was an AD permission issue but I created the WSFC and AG group using the same credentials.
Did I miss something obviously like using an invalid listener name? The documentation says the maximum for SSMS is 15 characters and this is 14?
Thanks

is the account creating the listener an AD admin?

-----------------------------------------------------------------------------------------------------------

"Ya can't make an omelette without breaking just a few eggs" 😉

as_1234 SSCrazy Points: 2864 More actions · Answer 2

Hello,

Thanks for your help.

It might not have all the admin permissions but it should have enough to do this. I think the permissions required are the same as for creating the cluster and the AG?

Thanks

Andrew

Perry Whittle SSC Guru Points: 234013 More actions · Answer 3

as1981 - Thursday, September 7, 2017 7:00 AM
Hello,
Thanks for your help.
It might not have all the admin permissions but it should have enough to do this. I think the permissions required are the same as for creating the cluster and the AG?
Thanks
Andrew

it quite probably doesnt, to be sure, have an AD admin pre stage the CNO and VCO accounts as detailed in the following link

https://technet.microsoft.com/en-us/library/dn466519.aspx

-----------------------------------------------------------------------------------------------------------

"Ya can't make an omelette without breaking just a few eggs" 😉

doodlingdba Hall of Fame Points: 3164 More actions · Answer 4

Just carrying on from Perry's advice, if you are a DBA without Domain Admins permissions, but want to control as much of the install as you can, make sure the infrastructure guys place all your SQL servers in their own OU, and get yourself admin access just on that OU. Some companies have more than one data center so will have separate OUs depending on location of SQL Servers, but Microsoft recommend that you keep both nodes of a cluster in the same OU. Then you will be able to prestage all the cluster accounts yourself (without relying on the infrastructure guys) as per the article Perry posted above:

https://technet.microsoft.com/en-us/library/dn466519.aspx?f=255&MSPPError=-2147217396

You definitely will need to do the prestage step if the account under which you setting up AlwaysOn is not a domain admin

as_1234 SSCrazy Points: 2864 More actions · Answer 5

All,

Apologises for not replying to this.

Thanks for your help.

It now works but unfortunately I don't have a complete explanation to help others. I'll share what info I have in case it helps.

Our domain admins told me that my account had full permissions on the OU. They added the permissions in step 3 of this link https://technet.microsoft.com/en-us/library/dn466519.aspx to the Windows domain cluster object (which I had created with my account) and it worked.

Thanks