{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/", "slug": "dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it", "url": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/" }, "title": "Distinguish a cluster name object from the administrator who creates it", "summary": "Which Active Directory computer objects are created for a domain failover cluster?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:46+00:00", "modified_at": "2026-09-08T18:23:27+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 201, "potentially_affected": "Administrators reviewing Active Directory identities used by Windows failover clusters.", "dse_recommendation": "Maintain an inventory separating the administrator account, CNO, and role-specific computer objects.", "primary_source": { "name": "Failover cluster accounts overview", "url": "https://learn.microsoft.com/en-us/windows-server/failover-clustering/failover-cluster-accounts-overview", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For the documented domain cluster, the creation wizards generate computer objects and assign required permissions. The cluster itself receives a cluster name object, or CNO. Most clustered services and applications receive additional computer accounts; Hyper-V VMs do not require a dedicated account through this process. The user who runs the cluster-creation wizard supplies the initial permission context from which the cluster account is created. Microsoft documentation.

\n

Applicability

\n

Identify the intended cluster, its domain location, creation account, and clustered roles. Review the required permissions and any prestaging procedure before changing objects or directory delegation.

\n

DSE recommendation

\n

Maintain an inventory separating the administrator account, CNO, and role-specific computer objects. Have the directory and cluster owners agree on who manages each object and its permissions. Before modifying an existing account, record the current access control and the cluster role that depends on it.

\n

Verification

\n

After approved creation or permission maintenance, inspect the expected objects and test the relevant network-name resources and role access. Correlate directory changes with cluster observations. Treat an unexpected missing account or altered permission as a finding to resolve rather than creating replacement identities without understanding the dependency.

\n

Official references

\n

Microsoft Learn: Failover cluster accounts overview. Source reviewed September 8, 2026.

", "content_text": "Source facts\nFor the documented domain cluster, the creation wizards generate computer objects and assign required permissions. The cluster itself receives a cluster name object, or CNO. Most clustered services and applications receive additional computer accounts; Hyper-V VMs do not require a dedicated account through this process. The user who runs the cluster-creation wizard supplies the initial permission context from which the cluster account is created. Microsoft documentation.\nApplicability\nIdentify the intended cluster, its domain location, creation account, and clustered roles. Review the required permissions and any prestaging procedure before changing objects or directory delegation.\nDSE recommendation\nMaintain an inventory separating the administrator account, CNO, and role-specific computer objects. Have the directory and cluster owners agree on who manages each object and its permissions. Before modifying an existing account, record the current access control and the cluster role that depends on it.\nVerification\nAfter approved creation or permission maintenance, inspect the expected objects and test the relevant network-name resources and role access. Correlate directory changes with cluster observations. Treat an unexpected missing account or altered permission as a finding to resolve rather than creating replacement identities without understanding the dependency.\nOfficial references\nMicrosoft Learn: Failover cluster accounts overview. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nFor the documented domain cluster, the creation wizards generate computer objects and assign required permissions. The cluster itself receives a cluster name object, or CNO. Most clustered services and applications receive additional computer accounts; Hyper-V VMs do not require a dedicated account through this process. The user who runs the cluster-creation wizard supplies the initial permission context from which the cluster account is created. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/failover-clustering/failover-cluster-accounts-overview).\n\n## Applicability\n\nIdentify the intended cluster, its domain location, creation account, and clustered roles. Review the required permissions and any prestaging procedure before changing objects or directory delegation.\n\n## DSE recommendation\n\nMaintain an inventory separating the administrator account, CNO, and role-specific computer objects. Have the directory and cluster owners agree on who manages each object and its permissions. Before modifying an existing account, record the current access control and the cluster role that depends on it.\n\n## Verification\n\nAfter approved creation or permission maintenance, inspect the expected objects and test the relevant network-name resources and role access. Correlate directory changes with cluster observations. Treat an unexpected missing account or altered permission as a finding to resolve rather than creating replacement identities without understanding the dependency.\n\n## Official references\n\n[Microsoft Learn: Failover cluster accounts overview](https://learn.microsoft.com/en-us/windows-server/failover-clustering/failover-cluster-accounts-overview). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/", "url": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish a cluster name object from the administrator who creates it", "item": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/", "url": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/", "headline": "Distinguish a cluster name object from the administrator who creates it", "description": "Which Active Directory computer objects are created for a domain failover cluster?", "abstract": "Which Active Directory computer objects are created for a domain failover cluster?", "articleBody": "Source facts\nFor the documented domain cluster, the creation wizards generate computer objects and assign required permissions. The cluster itself receives a cluster name object, or CNO. Most clustered services and applications receive additional computer accounts; Hyper-V VMs do not require a dedicated account through this process. The user who runs the cluster-creation wizard supplies the initial permission context from which the cluster account is created. Microsoft documentation.\nApplicability\nIdentify the intended cluster, its domain location, creation account, and clustered roles. Review the required permissions and any prestaging procedure before changing objects or directory delegation.\nDSE recommendation\nMaintain an inventory separating the administrator account, CNO, and role-specific computer objects. Have the directory and cluster owners agree on who manages each object and its permissions. Before modifying an existing account, record the current access control and the cluster role that depends on it.\nVerification\nAfter approved creation or permission maintenance, inspect the expected objects and test the relevant network-name resources and role access. Correlate directory changes with cluster observations. Treat an unexpected missing account or altered permission as a finding to resolve rather than creating replacement identities without understanding the dependency.\nOfficial references\nMicrosoft Learn: Failover cluster accounts overview. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:46+00:00", "dateModified": "2026-09-08T18:23:27+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-145-distinguish-a-cluster-name-object-from-the-administrator-who-creates-it/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish a cluster name object from the administrator who creates it" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 201, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Failover cluster accounts overview", "url": "https://learn.microsoft.com/en-us/windows-server/failover-clustering/failover-cluster-accounts-overview" } } ] } }