Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1239 Source: ClusSvc

Source
Level
Description
The Cluster service account does not have the following required user rights:

Manage auditing and security log

These user rights were granted to the Cluster service account during cluster setup and must not be removed.

Find detailed recovery steps in the knowledge base article:
http://go.microsoft.com/fwlink/LinkId=59968
(you may need to manually copy&paste the link above to your web browser)

User Action

Assign these rights to the Cluster service account. One way to do this is to  use Local Security Settings (Scepol.msc).

If these user rights are already granted to the Cluster service account in  Secpol.msc under Local Policies\User Rights Assignment a Group Policy object  might be overriding local settings and removing the rights.

If your organization implements Group Policy objects that override the local  security policies that remove a user right from the Cluster service by  changing the effective user rights you can work around this problem and get  the cluster service to start again by following these steps: (You may need  help from your organizationĘs domain administrators to complete these steps.)
1) Create a new organizational unit (OU) in the domain or in the forest and  then block policy inheritance on that OU.
2) Move the cluster nodes into the OU.
3) Start the Cluster service on each node.
4) Resolve the issues with the security policies that are restricting server  cluster operation so that the cluster nodes can be moved back to its original  location in the Active Directory.
Comments
 
This event may indicate that the cluster service account has become restricted because of a domain policy.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...