Understanding the Repair Active Directory Object Recovery Action

First published on MSDN on Dec 13, 2013

One of the responsibilities of cluster Name resource is to rotate the password of the computer object in Active Directory associated with it.  When the Name resource is online, it will rotate the password according to domain and local machine policy (which is 30 days by default).

If the password is different from what is stored in the cluster database, the cluster service will be unable to logon to the computer object and the Name will fail to come online.  This may also cause issues such as errors, failure to register in a secure DNS zone, and live migration to fail.

The Repair Active Directory Object option is a tool to re-synchronize the password for cluster computer objects.  It can be found in Cluster Manager (CluAdmin.msc) by right-clicking on the Network Name, selecting More Actions…, and then clicking Repair Active Directory Object.

    • Cluster Name Object (CNO) – The CNO is the computer object associated with the Cluster Name resource.  When using Repair on the Cluster Name, it will use the credentials of the currently logged on user and reset the computer objects password.  To run Repair, you must have the “Reset Password” permissions to the CNO computer object.
    • Virtual Computer Object (VCO) – The CNO is responsible for managing the passwords on all other computer objects (VCO's) for other cluster network names in the cluster.  If the password for a VCO falls out of sync, the CNO will reset the password and self-heal automatically.  Therefore it is not needed to run Repair to reset the password for a VCO.  In 2012 a Repair action was added for all other cluster Network Names, and is a little bit different.  Repair will check to see if the associated computer object exists in Active Directory.  If the VCO had been accidentally deleted, then using Repair will re-create the computer object if it is missing.  The recommended process to recover deleted computer objects is with the AD Recycle Bin feature, using Repair to re-create computer objects when they have been deleted should be a last resort action.  This is because some applications store attributes in the computer object (namely MSMQ), and recreating a new computer object will break the application.  Repair is a safe action to perform on any , or File Server deployment.  The CNO must have “Create Computer Objects” permissions on the OU in which it resides to recreate the VCO's.

To run Repair, the Network Name resource must be in a “Failed” or “Offline” state.   Otherwise the option will be grayed out.

Repair is only available through the Cluster Manager snap-in, there is no Powershell cmdlet available to script the action.

If you are running Windows Server 2012 and find that you are having to repeatedly run Repair every ~30 days, ensure you have hotfix KB2838043 installed.

Matt Kurjanowicz
Senior Software Development Engineer
Clustering & High-Availability


This article was originally published by Microsoft’s Failover Clustering Blog. You can find the original article here.