High Availability DNS Service Account Name Considerations (Special Characters and SID Resolution)

Environment

• SolarWinds Platform with High Availability

• HA Pool using Microsoft DNS for Virtual Host Name (VHN) management

• Non-domain-admin DNS account configured in the HA DNS settings

Problem

When using a non-domain-admin DNS account whose sAMAccountName contains certain special characters (for example, #), you may see:

• DNS permission validation tools or scripts returning:

  • Could not resolve SID

  • Some or all identity references could not be translated

• wbemtest to \\<DNS server>\root\MicrosoftDNS with that account failing with:

  • 0x80070005 Access is denied

• The HA DNS Test in the HA Pool wizard failing consistently, even after following the DNS permissions KB.

• DCOM, WMI namespace, and DNS Server Security permission entries not applied correctly for the account.

• Some special characters in AD sAMAccountName values can cause SID resolution failures on DNS servers.

• When SID resolution fails, DCOM, WMI, and DNS Security permission configuration tools cannot correctly create access control entries for the account.

• As a result, even if the account exists in AD, the required permissions are not applied, and the account receives Access is denied when HA attempts Microsoft DNS operations.

A. Validate the account before configuring HA

(No downtime required)

Before using the account in the HA DNS settings, confirm that it resolves to a SID from a domain-joined server with the AD module:

Get-ADUser 'solarwindsSAM_HA_svc' -Properties SID

or

Get-ADObject -LDAPFilter "(sAMAccountName=solarwindsSAM_HA_svc)" -Properties objectSid

Expected: output shows the user object and a valid SID value.

If this fails, the account name may contain characters that prevent resolution. Proceed to step B.

B. Use an account name without problematic special characters

(No downtime required)

• Avoid characters in sAMAccountName that can cause SID resolution failures (for example, #).

• Recommended pattern:

  • DOMAIN\solarwindsSAM_HA_svc

• If the current account name contains a problematic character, kindly rename the account or create a new account with a clean naming convention, then re-validate using step A before configuring HA.

C. Apply the DNS permissions KB to the corrected account

(No downtime required)

After confirming the account resolves to a SID:

1. Follow the "Required DNS Permissions to set up a High Availability Pool and access Microsoft DNS" KB to configure DCOM, WMI root\MicrosoftDNS, and DNS Server Security permissions for the new account.

2. If using a DNS VIP with multiple backend DNS servers, apply the permissions on each backend DNS server behind the VIP.

3. From the active MPE / Orion server, validate access using wbemtest:

   • Connect to \\<DNS server or DNS VIP>\root\MicrosoftDNS using the corrected HA account.

   • Run:

SELECT Name FROM MicrosoftDNS_Zone

Expected: connection succeeds and returns the list of DNS zones.

D. Update the HA DNS settings

(No downtime required)

1. In the web console, go to Settings > All Settings > High Availability Deployment Summary.

2. Edit the HA Pool DNS Settings and update the credentials to the corrected account.

3. Click Test to confirm the HA DNS Test passes.

4. Save the changes.

Validation

• Get-ADUser or Get-ADObject returns a valid SID for the account.

• wbemtest to \\<DNS server>\root\MicrosoftDNS connects successfully and SELECT Name FROM MicrosoftDNS_Zone returns the DNS zones.

• The HA DNS Test in the HA Pool wizard completes successfully.

• The HA Virtual Host Name resource shows Up in the HA Deployment Summary.