This may cause Cluster Shared Volumes (CSV) on the nodes Failover Clusters to going into a paused state with an event ID 5120 in the System event log that indicates “Status c000020c – STATUS_CONNECTION_DISCONNECTED”.
You will also find that, on the node that owns the CSV volume(s), there will be an event ID 7031 with the source: “Service Control Manager”, which indicates “The Windows Firewall Service terminated unexpectedly”.
Microsoft is aware of this problem and are working on a fix with high priority.
Until the hotfix is released, there are 2 known ways to workaround this problem at the moment:
Option 1. Disable the Firewall Logging for all profiles (domain, private, public).
a. Start the Windows Firewall with Advanced Security management console (wf.msc)
b. Right-click Windows Firewall with Advanced Security on Local Computer and select Properties
c. For all profiles (Domain, Private, Public), under Logging, click Customize. Set Log Dropped Packets and Log Successful connections to NO. Or by using the following PowerShell cmdlet: Set-NetFirewallProfile -LogBlocked 0 -LogIgnored 0
More information on Troubleshooting Cluster Shared Volume Auto-Pauses – Event 5120
I will update this post as soon as Microsoft releases the Hotfix for this issue.