SQL AlwaysON Listener The WSFC cluster could not bring the Network Name resource with DNS name ‘LNSxxxx’ online.

When creating a Listener for an AlwaysOn Availability group, I received the below error:

Msg 19471, Level 16, State 0, Line 1

The WSFC cluster could not bring the Network Name resource with DNS name ‘LNSxxx’ online. The DNS name may have been taken or have a conflict with existing name services, or the WSFC cluster service may not be running or may be inaccessible. Use a different DNS name to resolve name conflicts, or check the WSFC cluster log for more information.

Msg 19476, Level 16, State 4, Line 1

The attempt to create the network name and IP address for the listener failed. The WSFC service may not be running or may be inaccessible in its current state, or the values provided for the network name and IP address may be incorrect. Check the state of the WSFC cluster and validate the network name and IP address with the network administrator.

The AlwaysOn Availability group had created cleanly, with the exception of the listener.

The cluster error log showed:

Cluster network name resource ‘AG****’ failed to create its associated computer object in domain ‘poad.patent.gov.uk’ for the following reason: Unable to create computer account.

The text for the associated error code is: Access is denied.

Please work with your domain administrator to ensure that: – The cluster identity ‘*****$’ can create computer objects. By default all computer objects are created in the ‘Computers’ container; consult the domain administrator if this location has been changed. – The quota for computer objects has not been reached. – If there is an existing computer object, verify the Cluster Identity ‘****$’ has ‘Full Control’ permission to that computer object using the Active Directory Users and Computers tool.

Solution

The error message from the cluster was the most useful. In my case, computer objects were forwarded to a holding OU and were not located in the Computers OU. I gave the computer account full permissions to the OU, and re-ran the TSQL to create the listenet.

Nb – Full permissions is not a best practice –  documentation suggests that the computer account requiires create computer & delete computer permissions.