Event ID - 1247

Event Id	1247
Source	Microsoft-Windows-FailoverClustering
Description	The Cluster service SID type is configured as '%1' while the expected service sid type is Unrestricted. The Cluster service is modifying its sid type configuration with the Service Controller Manager and will be restarted for this change to take effect.
Event Information	According to Microsoft : Cause : This event is logged when Cluster service SID type is configured as while the expected service sid type is Unrestricted. Resolution : Confirm success of security ID configuration change Sometimes, before the Cluster service can function, it must modify its security ID (SID) type configuration with the Service Controller Manager and then restart for the change to take effect. No action is necessary, but monitor the status of the node to ensure that it comes up as expected. If you do not currently have Event Viewer open, see "Opening Event Viewer and viewing events related to failover clustering." To perform the following procedure, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority. To open Event Viewer and view events related to failover clustering: If Server Manager is not already open, click Start , click Administrative Tools , and then click Server Manager . If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue . In the console tree, expand Diagnostics, expand Event Viewer , expand Windows Logs , and then click System . To filter the events so that only events with a Source of FailoverClustering are shown, in the Actions pane, click Filter Current Log . On the Filter tab, in the Event sources box, select FailoverClustering . Select other options as appropriate, and then click OK . To sort the displayed events by date and time, in the center pane, click the Date and Time column heading. Verify : Confirm that the nodes are running and that the backup or restore process succeeded. To perform this procedure, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority. Viewing the status of the nodes in a failover cluster To view the status of the nodes in a failover cluster: To open the failover cluster snap-in, click Start , click Administrative Tools , and then click Failover Cluster Management . If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue . n the Failover Cluster Management snap-in, if the cluster you want to manage is not displayed, in the console tree, right-click Failover Cluster Management , click Manage a Cluster , and then select or specify the cluster that you want. If the console tree is collapsed, expand the tree under the cluster you want to manage, and then click Nodes . View the status for each node. If a node is Up , the Cluster service is started on that node. Another way to view node status is to run a command on a node in the cluster. Using a command to view the status of the nodes in a failover cluster To use a command to view the status of the nodes in a failover cluster: On the node that you are checking, click Start , point to All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator . Type: CLUSTER NODE /STATUS If the node status is Up , the Cluster service is started on that node.
Reference Links	Event ID 1247 from Microsoft-Windows-FailoverClustering

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught