Issue 1
You have a file share resource that is hosted on a Windows Server 2012-based failover cluster, and you try to access the file share from a Windows XP-based or Windows Server 2003-based computer. In this scenario, you cannot access the resource, and you receive the following error message:
<path> is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions. Logon Failure: The target account name is incorrect.
At the same time, the following Error event is logged in the event log of the Windows XP-based or Windows Server 2003-based computer:
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 4
Description:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server <cluster-file-server$>. The target name used was cifs/cluster-file-server.domain.com.
This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (domain.COM), and the client realm. Please contact your system administrator.
Notes- The file share resource can be accessed if you connect to it by using the IP address.
- You may also see "SMB:KrbError: KRB_AP_ERR_MODIFIED (41) R; Session Setup Andx, Krb5Error (0x300)" for the SMB Session Setup server response in a network trace.
- You do not see this behavior with Windows 7 and later client computers unless you force them to use rc4-hmac.
Issue 2
When you attempt to bring a network name resource online in a Windows Server 2012-based failover cluster, the attempt fails. Additionally, the following events are logged in the System log:
Event ID 1228
Cluster network name resource 'Cluster Name' encountered an error enabling the network name on this node. The reason for the failure was: 'Unable to obtain a logon token'. The error code was '1326'. You may take the network name resource offline and online again to retry.
Event ID 1196
Cluster network name resource 'Cluster Name' failed registration of one or more associated DNS name(s) for the following reason: The handle is invalid. Ensure that the network adapters associated with dependent IP address resources are configured with at least one accessible DNS server.
Also, you may see the following in the cluster log:
INFO [RES] Network Name: [NNLIB] LsaCallAuthenticationPackage success with a request of size 82, result size 0 (status: 0, subStatus: 0)
WARN [RES] Network Name: [NNLIB] LogonUserEx fails for user E0117-C1$: 1326 (useSecondaryPassword: 0)
WARN [RES] Network Name: [NNLIB] LogonUserEx fails for user E0117-C1$: 1326 (useSecondaryPassword: 1)
WARN [RES] Network Name <Cluster Name>: AccountAD: Slow operation has exception ERROR_INVALID_HANDLE(6)' because of '::ImpersonateLoggedOnUser( GetToken() )'
ERR [RES] Network Name <Cluster Name>: Online thread Failed: ERROR_SUCCESS(0)' because of 'Initializing netname configuration for ‘Cluster Name’ failed with error 6.'
INFO [RES] Network Name <Cluster Name>: All resources offline. Cleaning up.
ERR [RHS] Online for resource Cluster Name failed. Error 6 -> The Handle is invalid.
Issue 3
The live migration of virtual machines between Windows Server 2012 hosts fail. When this occurs, the following event may be logged:
Event ID 21502
Live migration of 'VM name' failed. Virtual machine migration operation for 'VM name' failed at migration source 'Node name'
The Virtual Machine Management Service failed to establish a connection for a Virtual Machine migration with host 'Node name': The logon attempt failed (0x8009030C).
The Virtual Machine Management Service failed to authenticate the connection for a Virtual Machine migration at the source host: The logon attempt failed (0x8009030C).