| Event Id | 7031 |
| Source | Cluster Service |
| Description | The Cluster Service service terminated unexpectedly. It has done this X time(s). The following corrective action will be taken in XXXXXX milliseconds. Restart the service. |
| Event Information | According to Microsoft: CAUSE: This problem may occur after you apply a security template through a domain policy or by manually setting the LAN Manager Authentication Level Local Security Policy option to anything other than Send LM and NTLM responses on the nodes in a Windows 2000-based cluster. The Cluster service does not function properly using NTLM 2. All cluster authentication is handled internally to the Cluster service after using RPC datagrams to form a cluster. The only time the Cluster service contacts a domain controller for authentication is when the cluster is first formed to validate the Cluster service account. Every node that requests to join a cluster is validated by using RPC communication over the private network by the node that owns the quorum resource. Only LM or NTLM authentication is used. RESOLUTION: To resolve this problem, return the NTLM authentication level to its default level of Send LM and NTLM responses. Follow these steps on each node in your Windows 2000-based cluster: 1. In Control Panel, double-click Administrative Tools. 2. Start the Local Security Policy tool. 3. Expand Local Policies, and then click Security Options. 4. Double-click Lan Manager Authentication Level, and then click Send LM and NTLM responses. 5. Click OK, and then quit Local Security Policy Editor. 6. Restart the server. |
| Reference Links | Cluster Service Does Not Start on "Joining" Node in Windows 2000 Cluster Hisecdc Causes Problems with Cluster Domain Controllers Cluster service configuration wizard does not start Cluster service |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.