We recently got an issue where the Windows Search service wasn’t getting started on a Windows 2012 Server, although the indexing status shows the service is running but when you actually start it, it fails. Following event is also logged in application log

Faulting application name: SearchIndexer.exe, version: 7.0.9600.16384,  
Faulting module name: msvcrt.dll, version: 7.0.9600.16384,  
Exception code: 0x40000015 
 
Faulting application path: C:\Windows\system32\SearchIndexer.exe 
Faulting module path: C:\Windows\system32\msvcrt.dll 

We did some research and tried following steps on the machine’s registry,

Took Ownership and full control over the following key and all the keys under it

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search

Deleted  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search Key

Also imported the keyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search from a working Windows 2012 server.

Performed multiple reboots of the server, however the service still fails to get started.

How we fixed it

We executed a Procmon scan to find that some estranged data in this HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\CrawlScopeManager reg key was causing the search service to crash.

We tried to rebuild the searcher index manually by editing the following registry key:

HKLM/Software/Microsoft/Windows Search/SetupCompletedSuccessfully

to zero and then restarting the machine.

It still didn’t fix the issue and we did get the Estranged data back in CrawlScopeManager key.

As the key got repopulated, we were confident that its something which is still there and is pushing the changes on server, obviously sounds like a group policy. To rule out group policy issues we

1) Placed the server in a test OU with blocked inheritance

2) Disabled the local GPO on the server

3) Rebooted the server couple of times and still the corrupt value managed to sneak back in under CrawlScopeManager Key

It looks like some policies are tattooed on the server and are not letting it go.  We tested various windows Search related policies on the server and at last found issue with “DefaultIndexedPaths” policy.We found that Windows Search policies are getting read from the location below.
HKLM\Software\Microsoft\Windows Search\CurrentPolicies
 

We took a backup of the CurrentPolicies Key and Deleted it, restarted the server.  Windows Search Service got started with flying colors.

 Hope this solution help you resolve the issue, else you can reach out to us for Paid support Here

The following two tabs change content below.
An automobile enthusiast at heart and computer geek by profession, started my Career with MS in 2005.Left Jobs and started Pledge Technologies (the parent company to Grishbi) back in 2009.We have been providing IT consulting to various Small and Medium businesses across US and UK since then.Our company specialises in Microsoft Server technologies like AD, Exchange, the rest and with numerous Office 365 migrations under our belt, we quite an expert with that too. Whatever we learn in our day to day life, we share it back on Grishbi as a Thank for all the love and support our customers have given us.
%d bloggers like this: