Cluster Nodes and Windows Domains

Cluster Nodes and Windows Domains
All nodes in the cluster must be members of the same
domain and able to access a domain controller and a Domain
Name System (DNS) server, as well as a WINS server. The
nodes should not be configured as domain controllers if
you are going to install SQL Server, as you may encounter
some problems, including the fact that domain controller
functionality (such as Active Directory) is not cluster
aware, so all information will be local. This impacts
things such as a directory enabled program's ability to
publish under the virtual server's computer object, which
does not work in a cluster. A WINS server is still
required for Windows 2000/SQL Server 2000 in a clustered
environment if name resolution of virtual resource is
required.
My question:
After reading the above paragraph. I want to setup two
nodes as peer to peer domain controllers running Windows
2000 Advanced, SQL Server 2000, Active directory service
running on each node, in a cluster environment.
What part of this is not cluster aware?
Why do I need a WINS server if I have DNS?
Why can't my nodes be a domain controller?( I'm using the
company's DNS server)
What does this means? (directory enabled program's ability
to publish under the virtual server's computer object,
which does not work in a cluster.)I would never, ever recommend installing SQL Server on a domain controller.
The security exposure is huge.
Steve
"Tony" <tony.baks@.tdh.state.tx.us> wrote in message
news:038001c35089$9061b550$a301280a@.phx.gbl...
> Cluster Nodes and Windows Domains
> All nodes in the cluster must be members of the same
> domain and able to access a domain controller and a Domain
> Name System (DNS) server, as well as a WINS server. The
> nodes should not be configured as domain controllers if
> you are going to install SQL Server, as you may encounter
> some problems, including the fact that domain controller
> functionality (such as Active Directory) is not cluster
> aware, so all information will be local. This impacts
> things such as a directory enabled program's ability to
> publish under the virtual server's computer object, which
> does not work in a cluster. A WINS server is still
> required for Windows 2000/SQL Server 2000 in a clustered
> environment if name resolution of virtual resource is
> required.
> My question:
> After reading the above paragraph. I want to setup two
> nodes as peer to peer domain controllers running Windows
> 2000 Advanced, SQL Server 2000, Active directory service
> running on each node, in a cluster environment.
> What part of this is not cluster aware?
> Why do I need a WINS server if I have DNS?
Many applications still require WINS...
> Why can't my nodes be a domain controller?( I'm using the
> company's DNS server)
HUGE security exposure, consider using a member server for your SQL Server
implementation.
> What does this means? (directory enabled program's ability
> to publish under the virtual server's computer object,
> which does not work in a cluster.)

Cluster Node Communications

I just rebuilt a 2 node W2k/SQL2k cluster that resides in
a NT4 domain. The cluster itself seems to be working
fine, the website that runs off of the virtual SQL server
is running fine.
However, both nodes in the cluster are not able to
communicate with other machines in my 2 other
trusted/trusting domains. My other 2 domains are W2k
based domains. Prior to the rebuild there were no
communication problems accross domains.
If I try to browse to the nodes in Windows Explorer I get
the message "No logon servers currently available to
service your request" and if I try to logon to one of the
nodes at the console using my user name and domain, it
says the domain is unavailable.
Any assistance would be greatly appreciated.
Patrick G.
You can check a few things.
1. Make sure your domain trust(s) are still in place and functioning correctly. If you don't have the W2K support tools installed (ie in a prod environment), run dsa.msc and check that you can browse the remote domain and list groups and users in the rem
ote domain (eg attempt to add a global group from the remote domain to a local domain group - you can do this with committing the change).
2. Make sure the account you are using has a valid SQL Server login on the remote SQL Server (or your account is in the builtin admins group on the remote server - if the other domain are willing to trust you with local admins on the remote server or the
remote domain).
Are both domains in W2K native or do you have W2K and W2K3 forests in the mix?

Cluster installation & Domain Group requirements...

Why does a cluster install of SQL2005 require access to a domain group and what is the purpose of having to create a domain group for the cluster installation? Other than the blurb mentioned in BOL I'm having a hard time finding any information out about this requirement.

From BOL: How to create a failover cluster.

Section 18: On the Domain Groups for Clustered Services page, provide a DomainName\GroupName for each clustered service being installed: the SQL Server service, SQL Server Agent service, Analysis Services service, and Full-Text Search service must run as domain accounts that are members of the built-in administrators group on each node of the cluster. To proceed, click Next. For more information, see Domain Groups for Clustered Services.

The purpose for domain groups in cluster installation is security consideration. As SQL Server service accounts in a local group can be changed or removed after SQL Server 2005 is installed. Then the security setting like ACL will be lost. That is why domain group\account is introduced.

|||

Ok, that's kind of what I thought it was for.

Is there any way to change the group after installation? Can I just move the account to another group and be done with it? Or is there somewhere (in SQL Server) that I need to update the group if we desire to change groups?

sqlsql

Cluster install...domain group.

As part of the cluster install a domain group is required now.

My question is, can I remove this group after the install or change the group without affecting the server?

No, you cannot. All permissions - i.e. file system, registry, sql, etc. - are assigned to the group now in SQL 2005 rather than the user. This is to allow better control over the appropriate service accounts at the domain level, plus ease the case where you want to change service accounts for your server.

cluster admin - rights needed ?

I have read that the cluster admin needs to be a domain admin to setup a
cluster. I am using Win2003 and SQL 2000. Is that true ? If not, what are
the minimum rights required as our n/w admins are hesitant about creating it
as a member of domain admins
Don't be - The answer you got below is correct.
HTH
Bjorn
>--Original Message--
>A microsoft person responded to me (see RE: Services
login policies and
>rights question - "Yuan Shao") that the cluster admin
needs to be a Domain
>Admin...
>Now I'm confused.
>
>
>"Loay Shbeilat [MS]" <loays@.microsoft.com> wrote in
message
>news:eBLL%23G1GEHA.2876@.TK2MSFTNGP09.phx.gbl...
documents? Plz
>point
and confers no
domain admin to setup a
true ? If not, what
>are
hesitant about
>creating
>
>.
>
|||hmm... I guess that Yuan Shao is mistaken !!!
I think he meant that the domain user should be a local administrator on the
nodes.
You can trust me on this one :-) Also check this article on microsoft
website:
http://www.microsoft.com/technet/pro...on124121120120
Under checklist for Server Cluster Configuration-
"A domain-level account that is a member of the local administrators group
on each node. A dedicated account is recommended."
Ya, it is a bit confusing, but it means: "A domain user with admin
previliges on each of the cluster nodes"
Thanks,
Loay Shbeilat
MSCS Admin Tools STE
"This posting is provided "AS IS" with no warranties, and confers no
rights."
"frankm" <frank@.nxspxm.mallardcentral.com> wrote in message
news:%23Jdk7e1GEHA.2224@.TK2MSFTNGP12.phx.gbl...
> A microsoft person responded to me (see RE: Services login policies and
> rights question - "Yuan Shao") that the cluster admin needs to be a Domain
> Admin...
> Now I'm confused.
>
>
> "Loay Shbeilat [MS]" <loays@.microsoft.com> wrote in message
> news:eBLL%23G1GEHA.2876@.TK2MSFTNGP09.phx.gbl...
> point
a
> are
> creating
>
|||That's the way I understood it...
unfortunately things do change - so I don't take chances
"Loay Shbeilat [MS]" <loays@.microsoft.com> wrote in message
news:O%23wpOh$GEHA.1528@.TK2MSFTNGP09.phx.gbl...
> hmm... I guess that Yuan Shao is mistaken !!!
> I think he meant that the domain user should be a local administrator on
the
> nodes.
> You can trust me on this one :-) Also check this article on microsoft
> website:
>
http://www.microsoft.com/technet/pro...on124121120120
> Under checklist for Server Cluster Configuration-
> "A domain-level account that is a member of the local administrators group
> on each node. A dedicated account is recommended."
> Ya, it is a bit confusing, but it means: "A domain user with admin
> previliges on each of the cluster nodes"
> --
> Thanks,
> Loay Shbeilat
> MSCS Admin Tools STE
> "This posting is provided "AS IS" with no warranties, and confers no
> rights."
> "frankm" <frank@.nxspxm.mallardcentral.com> wrote in message
> news:%23Jdk7e1GEHA.2224@.TK2MSFTNGP12.phx.gbl...
Domain
setup
> a
what
>
|||Actually it doesn't take much these days...
"Bjorn Mobak" <anonymous@.discussions.microsoft.com> wrote in message
news:1936301c41bed$744a4500$a101280a@.phx.gbl...
> Don't be - The answer you got below is correct.
> HTH
> Bjorn
> login policies and
> needs to be a Domain
> message
> documents? Plz
> and confers no
> domain admin to setup a
> true ? If not, what
> hesitant about

Client Network Utility cannot create alias for VPN SQL server connection?

I am trying to connect two SQL servers in different non-trusted domains.
SQLServer11 in Domain A and SQLServer22 in domain B. This is through a VPN
connection. Domain A has the VPN server. On SQLServer22 I could ping
SQLServer11.mydomain.local at IP address 192.168.100.50. On SQLServer22 I
use the client network utility to create an alias for SQLServer11 as
follows:
Network Libraries: TCP/IP
Server name: 192.168.100.50
Port No: 1433
Server alias: SQLServer11
Then I registered the new SQLServer11 in enterprise manager. But I keep
getting the error message "SQL server does not exist or access
denied.ConnectionOpen(Connect())" .
Why is this so? And how can I rectify the problem'If you use ping -a <ip address> does it bring back the correct name for the
server? If you ping SQLServer11 does it return the proper ip address? If
you are using NT authentication to register then try SQL authentication..
Verify that it is using port 1433 and that SQL Server is actually listening
on TCP/IP.
Rand
This posting is provided "as is" with no warranties and confers no rights.

Client connect to SQL SERVER 2000

Hello,
I have one SQL Server 2000 that has been installed into a domain,
having allowed "Windows and SQL Server" authentication and using as
connectivity options Named Pipes and TCP/ip - 1433
On every client computer that is also a domain member I can set up
without any problems DSNs (data source names), and connect to the SQL Server.
My problem is on another computer that is not a member of this
domain and on which I can not set any kind of connections to SQL Server, I`ve
tried setting up also a DSN (using an SQL Server account)and connect from
Excel and even install the SQL Server Connectivity Tools, and tried with
Query Analyzer but still I wasnt able to connect to the server.
The error I get is: Unable to connect to the SQL Server: The
server doesn't exist or access denied.
It must be some SQL Server specific settings as the network
connectivity is OK
Any ideas ...?
Thank You,
Razvan Dragomir,
MCSA, Exchange & Windows System Administrator
Try connecting to sql from the non-domain box using QA and an explicit
login. If it works, then try same login and password from your app as
opposed to using windows auth.
TheSQLGuru
President
Indicium Resources, Inc.
"Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
message news:F249BDA3-6D56-41E4-85E0-79110A1A9404@.microsoft.com...
> Hello,
> I have one SQL Server 2000 that has been installed into a domain,
> having allowed "Windows and SQL Server" authentication and using as
> connectivity options Named Pipes and TCP/ip - 1433
> On every client computer that is also a domain member I can set up
> without any problems DSNs (data source names), and connect to the SQL
> Server.
> My problem is on another computer that is not a member of this
> domain and on which I can not set any kind of connections to SQL Server,
> I`ve
> tried setting up also a DSN (using an SQL Server account)and connect from
> Excel and even install the SQL Server Connectivity Tools, and tried with
> Query Analyzer but still I wasnt able to connect to the server.
> The error I get is: Unable to connect to the SQL Server: The
> server doesn't exist or access denied.
> It must be some SQL Server specific settings as the network
> connectivity is OK
> Any ideas ...?
> Thank You,
> --
> Razvan Dragomir,
> MCSA, Exchange & Windows System Administrator
>
|||Hi,
I tried and it doesnt work (i`ve used a valid SQL Login)...there is
another interesting thing..SQL is set to answer on port 1433 (default), but
if I scan this port from the non-domain workstation it`s like it`s not
opened, but it`s the same if i scan it from inside the domain where it also
doesn`t respond but I can Connect though...
Razvan Dragomir,
MCSA, Exchange & Windows System Administrator
"TheSQLGuru" wrote:

> Try connecting to sql from the non-domain box using QA and an explicit
> login. If it works, then try same login and password from your app as
> opposed to using windows auth.
>
> --
> TheSQLGuru
> President
> Indicium Resources, Inc.
> "Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
> message news:F249BDA3-6D56-41E4-85E0-79110A1A9404@.microsoft.com...
>
>
|||Firewall issue seems most likely culprit. Or TCP/IP isn't enabled as a
network protocol in sql server? Can you connect using QA and explicit ip
address as the server name?
TheSQLGuru
President
Indicium Resources, Inc.
"Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
message news:FBA2A6A8-90DF-4316-BF0A-B82ECB0D2D9C@.microsoft.com...[vbcol=seagreen]
> Hi,
> I tried and it doesnt work (i`ve used a valid SQL Login)...there is
> another interesting thing..SQL is set to answer on port 1433 (default),
> but
> if I scan this port from the non-domain workstation it`s like it`s not
> opened, but it`s the same if i scan it from inside the domain where it
> also
> doesn`t respond but I can Connect though...
> --
> Razvan Dragomir,
> MCSA, Exchange & Windows System Administrator
>
> "TheSQLGuru" wrote:
|||Hi,
Thx for the answers.....I don`t have any firewall between the
workstations and the server, I`m using TCP/IP and Named Pipes, and it`s
working to connect with IP address from QA, from inside the domain...I also
don`t have any firewall set for non domain clients...I`m just thinking if by
default Win2k3/SQL Server blocks connections from outside the domain...
Razvan Dragomir,
MCSA, Exchange & Windows System Administrator
"TheSQLGuru" wrote:

> Firewall issue seems most likely culprit. Or TCP/IP isn't enabled as a
> network protocol in sql server? Can you connect using QA and explicit ip
> address as the server name?
> --
> TheSQLGuru
> President
> Indicium Resources, Inc.
> "Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
> message news:FBA2A6A8-90DF-4316-BF0A-B82ECB0D2D9C@.microsoft.com...
>
>

Client connect to SQL SERVER 2000

Hello,
I have one SQL Server 2000 that has been installed into a domain,
having allowed "Windows and SQL Server" authentication and using as
connectivity options Named Pipes and TCP/ip - 1433
On every client computer that is also a domain member I can set up
without any problems DSNs (data source names), and connect to the SQL Server
.
My problem is on another computer that is not a member of this
domain and on which I can not set any kind of connections to SQL Server, I`v
e
tried setting up also a DSN (using an SQL Server account)and connect from
Excel and even install the SQL Server Connectivity Tools, and tried with
Query Analyzer but still I wasnt able to connect to the server.
The error I get is: Unable to connect to the SQL Server: The
server doesn't exist or access denied.
It must be some SQL Server specific settings as the network
connectivity is OK
Any ideas ...?
Thank You,
--
Razvan Dragomir,
MCSA, Exchange & Windows System AdministratorTry connecting to sql from the non-domain box using QA and an explicit
login. If it works, then try same login and password from your app as
opposed to using windows auth.
TheSQLGuru
President
Indicium Resources, Inc.
"Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
message news:F249BDA3-6D56-41E4-85E0-79110A1A9404@.microsoft.com...
> Hello,
> I have one SQL Server 2000 that has been installed into a domain,
> having allowed "Windows and SQL Server" authentication and using as
> connectivity options Named Pipes and TCP/ip - 1433
> On every client computer that is also a domain member I can set up
> without any problems DSNs (data source names), and connect to the SQL
> Server.
> My problem is on another computer that is not a member of this
> domain and on which I can not set any kind of connections to SQL Server,
> I`ve
> tried setting up also a DSN (using an SQL Server account)and connect from
> Excel and even install the SQL Server Connectivity Tools, and tried with
> Query Analyzer but still I wasnt able to connect to the server.
> The error I get is: Unable to connect to the SQL Server: The
> server doesn't exist or access denied.
> It must be some SQL Server specific settings as the network
> connectivity is OK
> Any ideas ...?
> Thank You,
> --
> Razvan Dragomir,
> MCSA, Exchange & Windows System Administrator
>|||Hi,
I tried and it doesnt work (i`ve used a valid SQL Login)...there is
another interesting thing..SQL is set to answer on port 1433 (default), but
if I scan this port from the non-domain workstation it`s like it`s not
opened, but it`s the same if i scan it from inside the domain where it also
doesn`t respond but I can Connect though...
--
Razvan Dragomir,
MCSA, Exchange & Windows System Administrator
"TheSQLGuru" wrote:

> Try connecting to sql from the non-domain box using QA and an explicit
> login. If it works, then try same login and password from your app as
> opposed to using windows auth.
>
> --
> TheSQLGuru
> President
> Indicium Resources, Inc.
> "Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
> message news:F249BDA3-6D56-41E4-85E0-79110A1A9404@.microsoft.com...
>
>|||Firewall issue seems most likely culprit. Or TCP/IP isn't enabled as a
network protocol in sql server? Can you connect using QA and explicit ip
address as the server name?
TheSQLGuru
President
Indicium Resources, Inc.
"Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
message news:FBA2A6A8-90DF-4316-BF0A-B82ECB0D2D9C@.microsoft.com...[vbcol=seagreen]
> Hi,
> I tried and it doesnt work (i`ve used a valid SQL Login)...there is
> another interesting thing..SQL is set to answer on port 1433 (default),
> but
> if I scan this port from the non-domain workstation it`s like it`s not
> opened, but it`s the same if i scan it from inside the domain where it
> also
> doesn`t respond but I can Connect though...
> --
> Razvan Dragomir,
> MCSA, Exchange & Windows System Administrator
>
> "TheSQLGuru" wrote:
>|||Hi,
Thx for the answers.....I don`t have any firewall between the
workstations and the server, I`m using TCP/IP and Named Pipes, and it`s
working to connect with IP address from QA, from inside the domain...I also
don`t have any firewall set for non domain clients...I`m just thinking if by
default Win2k3/SQL Server blocks connections from outside the domain...
--
Razvan Dragomir,
MCSA, Exchange & Windows System Administrator
"TheSQLGuru" wrote:

> Firewall issue seems most likely culprit. Or TCP/IP isn't enabled as a
> network protocol in sql server? Can you connect using QA and explicit ip
> address as the server name?
> --
> TheSQLGuru
> President
> Indicium Resources, Inc.
> "Razvan Dragomir" <RazvanDragomir@.discussions.microsoft.com> wrote in
> message news:FBA2A6A8-90DF-4316-BF0A-B82ECB0D2D9C@.microsoft.com...
>
>