Below are some of the Event Ids that you might see and encounter on the Event Logs when the Cluster service fails.

– Event ID 1000

Cluster service suffered an unexpected fatal error at line %1 of source module %2. The error code was %3

– Event ID 1006

Cluster service was halted due to incomplete connectivity with other cluster nodes

– Event ID 1073

The Cluster service was halted to prevent an inconsistency within the failover cluster. The error code was ‘%1′

– Event ID 1105

The Cluster service failed to start because it was unable to register interface(s) with the RPC service. The error code was ‘%1′

– Event ID 1135

Cluster node ‘%1′ was removed from the active failover cluster membership. The Cluster service on this node may have stopped. This could also be due to the node having lost communication with other active nodes in the failover cluster. Run the Validate a Configuration wizard to check your network configuration. If the condition persists, check for hardware or software errors related to the network adapters on this node. Also check for failures in any other network components to which the node is connected such as hubs, switches, or bridges

– Event ID 1146

The cluster resource host subsystem (RHS) stopped unexpectedly. An attempt will be made to restart it. This is usually due to a problem in a resource DLL. Please determine which resource DLL is causing the issue and report the problem to the resource vendor

– Event ID 1230

Cluster resource ‘%1′ (resource type ‘%2′, DLL ‘%3′) either crashed or deadlocked. The Resource Hosting Subsystem (RHS) process will now attempt to terminate, and the resource will be marked to run in a separate monitor

– Event ID 1234

Cluster service has detected that its service account is missing one or more from the required set of privileges. The missing privilege list is: ‘%1′ and is not currently granted to the service account. Please use the ‘sc.exe qprivs clussvc’ to verify the privileges of the Cluster Service (ClusSvc). Additionally check for any security policies or group policies in the Active Directory that may have altered the default privileges. Type the following command to grant the Cluster Service the necessary privileges to function correctly

– Event ID 1247

The Security Identifier (SID) type for the cluster service is configured as ‘%1′ but the expected SID type is ‘Unrestricted’. The cluster service is automatically modifying its SID type configuration with the Service Control Manager (SCM) and will restart in order for this change to take effect

– Event ID 1248

The Security Identifier (SID) ‘%1′ associated with the cluster service is not present in the process token. The cluster service will automatically correct this problem and restart.

– Event ID 1556

The cluster service encountered an unexpected problem and will be shut down. The error code was ‘%2′.

– Event ID 1561

The cluster service has determined that this node does not have the latest copy of cluster configuration data. Therefore, the cluster service has prevented itself from starting on this node.
Try starting the cluster service on all nodes in the cluster. If the cluster service can be started on other nodes with the latest copy of the cluster configuration data, this node will be able to subsequently join the started cluster successfully.

If the Cluster Service fails on a server (node), then that server can not act as part of a cluster. Windows Cluster needs the Cluster service to be running in order for it to work correctly.