ClusterService Log On Account and SQL2000

It is my understanding that this Active Directory account takes on the
role(s) of SQL's BuiltIn Administrator in a clustered environment.
Should the ClusterService Log On account password be reset in AD, without
reseting in the properties tab for the service on the physical nodes cluster
fail overs can still occur because the ClusterService has already been
started. BUT, what activity in SQL2000 could the AD account be doing on
behalf of the SQL BuiltIn Administrator account that would affect the
cluster and initiate a failover if it could not authenticate on the Domain?
Dave
That is not right. By default (God, I hate Microsoft's defaults), the
Cluster Service MUST BE a member of the Local Administrators group on each
cluster node, by which it gains access to the SQL Server installations
through the default BUILTIN\Administrators membership to the SQL Server
system admin default server role.
If you follow the security best practices, and you should, you will remove
the BUILTIN\Administrators group for the installation; however, the Cluster
Service account will still need access to run the resource monitor "Is
Alive" check, which, in the case for the SQL Server resource, is nothing but
the SELECT @.@.SERVERNAME query; thus, the Cluster Service account merely
needs access to the installation, but no special rights beyond this, as the
guest database user in the master database has permissions to execute this
query.
Sincerely,
Anthony Thomas

"David Currie" <decurrie@.rogers.com> wrote in message
news:%23aT3qmQBHHA.204@.TK2MSFTNGP04.phx.gbl...
> It is my understanding that this Active Directory account takes on the
> role(s) of SQL's BuiltIn Administrator in a clustered environment.
> Should the ClusterService Log On account password be reset in AD, without
> reseting in the properties tab for the service on the physical nodes
cluster
> fail overs can still occur because the ClusterService has already been
> started. BUT, what activity in SQL2000 could the AD account be doing on
> behalf of the SQL BuiltIn Administrator account that would affect the
> cluster and initiate a failover if it could not authenticate on the
Domain?
> Dave
>