Another quick post with a non-very-obvious solution, this time on a new Windows Server 2008 R2 cluster.
The case went like this:
The problem turned out to be that the built-in group “Authenticated Users” had been removed from the built-in group “Users” on the OS of each of the nodes. The customer didn’t want to add “Authenticated Users” back into this group as that would have granted too many accounts too many rights. The work-around we put in was to create a domain group and nest the newly created CNO into this group. This group was placed into the “Users” built in group on all the cluster nodes. In this way, the CNO now has membership in the built-in group “Users” on each of the nodes.
We needed to reboot all of the nodes before this change would take effect.
I hope this helps someone out there.