Something I ran across with a customer.
There aren’t many situations where service recoveries run automatically in Microsoft MP’s, but this is one case where they do. The cluster service running is critical to a healthy cluster. In the current cluster MP, the service monitor for the cluster service will automatically start the cluster service on a node, if it detects it stops. There is a recovery action on the monitor to do just that.
As always – if you don't like this intended behavior – you can override just the recovery, and disable it.
Why do you need to know this?
Because – some service packs for clustered applications, require you to stop the cluster service, in order to apply. If you stop this service on a node while doing application maintenance, SCOM will restart it, almost immediately. The correct solution – is to use Maintenance Mode in SCOM, which will unload the monitors, and hence, any automatic recoveries will no long run. So…. make SURE you are effectively using maintenance mode if you ever need to stop your cluster service, or, disable this automatic recovery action.