Windows Server 2012 R2 Cluster Node issues

I recently came across an error where nodes within a Windows Server 2012 R2 Cluster who stopped being active nodes within the cluster and continually cycled round trying to join again.

We were seeing errors:

Event 1070: Failover cluster nodes must have the ability to start the Cluster service, form a cluster (when a given node starts but no other nodes are up) and join a cluster (when a given node starts and discovers that one or more nodes are already up). This requires that certain conditions be met, for example, failover cluster nodes must run compatible versions of the operating system.

Event 1145: Cluster resource <resource> timed out. If the pending timeout is too short for this resource consider increasing the pending timeout value.

Within the event log over and over again.

We did some basic troubleshooting to check network connectivity, configuration etc.  One of our troublshooting steps included evicting a node and using the Clear-ClusterNode Powershell command to try and clear any configuration issues on the node.   When we tried to add the node back to the cluster we were presented with a new error "Event ID: 7024 The Cluster Service service terminated with the following service-specific error: Keyset does not exist".

We did some more digging and found that the permissions on the folder and files within C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys were largely missing.  This is the folder that holds the certificate keys that the cluster uses to connect.  Rather than change all the 38 files individually within the folder manually we came up with this wee script:

##This grants ownership of the folder and files below it to the administrator group.
takeown /f C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /R /A

##This grants the System and Administrators accounts Full Access to the machinekey folder and all it's subfolders/files, and removes any inherited permissions
icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" /INHERITANCE:R /GRANT ("SYSTEM" + ':(CI)(OI)F')
icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" /INHERITANCE:R /GRANT ("Administrators" + ':(CI)(OI)F') 

Once the permissions were set as above we were able to successfully add the node back into the cluster. And all four nodes were active again.

MS Ignite 2016

As I'm sure you are all aware MS Ignite this year was held in Atlanta in September for those of us not lucky enough to be there in person Microsoft have kindly put the session online via YouTube so we can view them.  With over 1000 sessions it can be a daunting task trying to figure out which ones to watch and which ones not to.  I've put together a list of six sessions I really enjoyed watching and think would be of benefit to you guys as well.

Session Name	Overview
BRK4010: Learn about Windows 10 Secure Kernel	Another informative session from Sami Laiho.
BRK2215: Debate the top 10 reasons not to move your Exchange on-premises mailboxes to Exchange Online	An informal dicussion with Messaging experts on the age old question, on-premises or cloud for Exchange.
BRK3218: Discover what's new and what's coming for Microsoft Outlook	A good look at what they are doing with end user feedback to develop Outlook into a more efficient product.
BRK2186: Introduce Windows Server 2016 into your environment	This is a good look at the new technologies that Windows Server 2016 has and how it can be used within your environment.
THR2141: Disrupt cyber-threats with revolutionary security in Windows 10	This is a quick overview of the security that is now built within Windows 10 to help mitigate against malware and hacking threats.
BRK4028: Case of the unexplained: Windows Troubleshooting with Mark Russinovich	Mark has had similar sessions at TechEd and Ignite in previous years and they are always very informative. He gives an insight into how the SysInternals tools can help to troubleshoot issues with malware, error messages, blue screens of death, and much more.

There is a nice PowerShell script available that can help you download the videos and slide decks to watch offline and store for future use over at the Technet Gallery:  https://gallery.technet.microsoft.com/Ignite-2016-Slidedeck-and-296df316

Running Configuration Manager 2012 Remote Control standalone

In some instances you might not want to roll out the full SCCM console but still allow the user to run the Remote Control SCCM tool.

Here is how to do it:

1. Find the directory where the AdminConsole is installed, example: C:\Program Files(x86)\Microsoft Configuration Manager\AdminConsole\bin\i386, copy the following directory and files:
0000049
CmRcViewer.exe
RdpCoreSccm.dll

2. Copy the whole directory and the files to the computer you want to run Remote Control from. You can create a folder anywhere on the computer, i.e My Documents\Remote Control

3. Then simply launch the CmRcViewer.exe file and that is you!