Event 1588 may be logged on a failover cluster in Windows Server 2008 or in Windows Server 2008 R2

On a failover cluster in Windows Server 2008 or in Windows Server 2008 R2, the following event may be logged:�




Note If the file server's shared folders cannot�come online,�the following events will be logged:




In the cluster log, you may see entries such as the following:


Note �Status 2310�signifies "This shared resource does not exist."

These events will be logged if one of the following actions was taken:

• There was a change to the shared folders that prevents access by the SYSTEM account.
• The shared folder was deleted or changed.

�

Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base: Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

The specific resolution for this issue depends on the cause of the problem. You must verify that the appropriate foldersexist and are accessible. Unfortunately, the event log does not provide sufficient information to let you�determine the folder path that you have to verify.�


To resolve this issue, follow these steps:

1. Determine the folder path of the failing shared folder.�To do this, follow these steps:
   1. Open Regedit.
   2. Locate HKLM\Cluster\Resources.
   3. Each <GUID> represents a different resource. As you review each <GUID>, look for a resource that has the file server name that is referenced in the event log as Event ID 1588 and is of task category File Server Service. In this case, you would look for a GUID that has the name FileServer-(WIN2008r2-cluFS)(Cluster Disk 2).
   4. After you find the resource, expand the tree. Beneath�Parameters�you will see the name of each share. Locate the share that is referenced in the Event 1058. TEST33 for Example. You see something that resembles the following:
      
      HKEY_LOCAL_MACHINE\cluster\resources\<GUID>\Parameters\Test33
      ShareName REG_SZ Test33
      Path REG_SZ R:\Test33
      
   5. Using Windows Explorer, try to locate the path that is specified by the registry entry Path.
2. If you determine that the specified path is missing, you can use one of the following options to resolve the error:
   
   Option 1�If the share is no longer needed, delete the registry entry under parameters that have the matching folder share name.
   Option 2�If the share has to be restored, note the folder path that is found in the registry, and then use Windows�Explorer to create the missing folder and path.�
3. If you determine that the path does in fact exist, the problem may be�that the folder cannot be accessed because of NTFS permissions. View the properties of the shared folder, and make sure that the SYSTEM account is listed as having the default value of full control.�
   
   Note The minimum permission of the SYSTEM account is READ.
   
   To update the�level of NTFS permissions, follow these steps:�
   
   1. Right-click the shared folder, and then select�Properties.
   2. Select the Security tab.
   3. Click Edit button, and then click the�Add button in the permissions dialog box.
   4. Click Object Types,�select only�Built-in security principals,�and then click�OK.
   5. In the Enter the object names to select�dialog, type the name SYSTEM, click�Check Names,�and then click�OK.
   6. With the SYSTEM account selected, click Allow by "Full control," and then click�OK.
4. Take the file server resource offline/online, and then verify that the error is resolved.

There are three ways to create a share folder in a highly available file server group by using built-in GUI tools:

1. Use the Failover Cluster Management snap-in. The "Add a shared folder" function is available in the Actions pane.
2. Use the Share and Storage Manager snap-in. The "Provision Share" function is available in the Actions pane.
3. Use Windows Explorer. Right-click the folder, and then than click Share with users (or nobody to stop sharing).�
   

If you wish to stop sharing a folder, you can use one of the following methods:�

1. In the Failover Cluster Management interface, right-click the shared folder, and then select�Stop Sharing.
2. In the Share and Storage Manager interface. right-click the share, and then select Stop Sharing.
3. In Windows Explorer, right-click the folder, and then select Share with Nobody.
   

If the folder is deleted before you select Stop Sharing, the errors that are described in the "Symptoms" section may be generated.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.