-1

I have a windows 2012 failover cluster set up with multiple roles, one file share role, and another a generic role for hosting Generic windows services configured to logon as Network Service. The share has NTFS permissions defined for the two host nodes (technically a domain group with both nodes included). The generic services connect via unc path to the clustered SMB share.

When the generic service role is owned by a node other than the one the share is owned by, the request is granted with evidence that it is correctly using machine SID. However, when both roles are running on the same machine, the request fails (specifying network service).

I'm looking for a solution to the permissions problem primarily, but an explanation for why this has changed since windows 2003 (where this worked) would be beneficial as well.

Failure log (when both roles on same node) A network share object was checked to see whether client can be granted desired access.

Subject: Security ID: NETWORK SERVICE Account Name: QAAPPCLUS1$ Account Domain: ECORESOURCE Logon ID: 0x3E4

Network Information:
Object Type: File Source Address: ### Source Port: 50905

Success log (when two roles are on different nodes) A network share object was checked to see whether client can be granted desired access.

Subject: Security ID: ECORESOURCE\QAAPPCLUS1$ Account Name: QAAPPCLUS1$ Account Domain: ECORESOURCE Logon ID: 0x15E7A9

Network Information:
Object Type: File Source Address: ### Source Port: 50993

1 Answer 1

0

Not sure why Network Service is no longer including Machine identity with share request on local box in windows 2012, but simply grant NT Authority\Network Service access to the share and configure NTFS permissions explicitly and the service will now be able to connect regardless of what node the share is resident on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .