Create a DAG with Exchange 2013/2016 – Troubleshooting

Once you tried to create a DAG (database Availability Group) with Microsoft Exchange Server 2013 or Exchange 2016, you may get many errors when you tried to add DAG member. It happens to me since I tried to use no Exchange server as witness server and forgot to add Exchange Trusted system group to local Administrators group once I tried to create an Exchange 2016 DAG in the LAB

So you’ve installed two or more Exchange 2016 servers with the Mailbox role and you decide to create the DAG with those two servers. So you create a DAG with a name of LABDAG-16…so good so far, no errors

Now you decide to add the first member to your DAG. Here are the errors you may encounter:

First Issue:  ACCESS DENIED

A server-side database availability group administrative operation failed. Error The operation failed. CreateCluster errors may result from incorrectly configured static addresses. Error: An error occurred while attempting a cluster operation. Error: Cluster API ‘”CreateCluster() failed with 0×5. Error: Access is denied”‘ failed.. [Server: MBX1.domain.int]

Cause: the ECP wizard tried to add the first mailbox server to the DAG. During this process the wizard create a computer object in Active Directory (the CNO). This object doesn’t have the good rights. Exchange Trusted Subsystem had special permissions assigned and not “Full Control” on CNO (LABDAG-16).

Resolution: assign “Full Control” to Exchange Trusted Subsystem on the CNO of the DAG from Security Tab.

Second Issue: DNS Host Name

An Active Manager operation failed with a transient error. Please retry the operation. Error: The fully qualified domain name for node '' could not be found.

Cause: if you go in the property of the CNO, in the tab ‘general’, you will see the field “DNS name” empty. The ECP cannot find this information, that’s why you have this message.

Resolution: go ADUC, expand to Computers OU, in the property of the CNO (LABDAG-16), in the tab ‘attribute Editor’ tab and search for the “dNSHostName” attribute. Enter the FQDN of the CNO (LABDAG-16.DOMAIN.COM, for my case) and apply.

Third Issue: CNO not disable

A computer account named ' LABDAG-16' already exists and is enabled. The account must be disabled in order to be used by the database availability group.

Cause: the CNO is enable. To operate the ECP need to have the CNO disable. The ECP will enable the CNO itself.
Resolution: GO in Active Directory and disable the CNO (LABDAG-16, for my case), and try it again.