I have a windows 2012 failover cluster set up with multiple roles, one file share role, and another a generic role for hosting Generic windows services configured to logon as Network Service. The share has NTFS permissions defined for the two host nodes (technically a domain group with both nodes included). The generic services connect via unc path to the clustered SMB share.
When the generic service role is owned by a node other than the one the share is owned by, the request is granted with evidence that it is correctly using machine SID. However, when both roles are running on the same machine, the request fails (specifying network service).
I'm looking for a solution to the permissions problem primarily, but an explanation for why this has changed since windows 2003 (where this worked) would be beneficial as well.
Failure log (when both roles on same node) A network share object was checked to see whether client can be granted desired access.
Subject: Security ID: NETWORK SERVICE Account Name: QAAPPCLUS1$ Account Domain: ECORESOURCE Logon ID: 0x3E4
Network Information:
Object Type: File
Source Address: ###
Source Port: 50905
Success log (when two roles are on different nodes) A network share object was checked to see whether client can be granted desired access.
Subject: Security ID: ECORESOURCE\QAAPPCLUS1$ Account Name: QAAPPCLUS1$ Account Domain: ECORESOURCE Logon ID: 0x15E7A9
Network Information:
Object Type: File
Source Address: ###
Source Port: 50993