Cluster IP address resource cannot be brought online because of a duplicate IP address

Microsoft.Windows.10.0.Cluster.Management.Monitoring.Cluster.IP.address.resource.cannot.be.brought.online.because.of.a.duplicate.IP.address (Rule)

Knowledge Base article:

Summary

Cluster IP address resource cannot be brought online because of a duplicate IP address

Resolutions

If you do not currently have Event Viewer open, see 'Opening Event Viewer and viewing events related to failover clustering.' Using the information in the event message, review the IP addresses already in use, and make sure the address assigned to the clustered IP Address resource is unique.

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

To open Event Viewer and view events related to failover clustering:

Element properties:

TargetMicrosoft.Windows.10.0.Cluster.Monitoring.Service
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Cluster IP address resource cannot be brought online because of a duplicate IP address
{0}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.10.0.Cluster.EventProvider Default
WA WriteAction Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.10.0.Cluster.Management.Monitoring.Cluster.IP.address.resource.cannot.be.brought.online.because.of.a.duplicate.IP.address" Enabled="true" Target="Clus8Library!Microsoft.Windows.10.0.Cluster.Monitoring.Service" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.10.0.Cluster.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>1049</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
<LogName>System</LogName>
<PublisherName>Microsoft-Windows-FailoverClustering</PublisherName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="ClusLibrary!Microsoft.Windows.Cluster.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.10.0.Cluster.Management.Monitoring.Cluster.IP.address.resource.cannot.be.brought.online.because.of.a.duplicate.IP.address.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>