How to Troubleshoot Search Permissions

MORE INFORMATION

Accounts Used when Crawling:

If the gatherer log indicates an Access Denied error when crawling, you may need to check the following items to make sure it's correctly configured. There are several places where an account can be set that affects the crawling of a catalog:

• The Site Server Gatherer Service account in Control Panel Services. By default, this is set to System account. It is recommended to leave it as it is.
  
  
• A Document Access Account can be set in the Catalog build server. This account will be used to crawl. This setting can be used to set a proper Exchange account when attempting to crawl an Exchange public folder. The account must have at least administrative access on the Configuration object for each site that hosts public folders.
  
  
  1. Go to the Site Server Management Console.
  2. Select Search.
  3. Select Computer Name.
  4. Select Catalog Build Server.
  5. Right-click Select Properties and click the Accounts tab.
  6. Set the Default Content Access Account.
• The account set in the rule of the catalog. This is particularly useful to crawl sites that are protected by either Basic Clear Text or Windows NT Challenge/Response authentication.
  
  
  1. Go to the Site Server Management Console.
  2. Select the Search snap-in.
  3. Select Computer Name.
  4. Select Catalog Build Server.
  5. Go to the property of the catalog.
  6. Go to sites.
  7. Select Add.
  8. Add the sites you want to crawl.
  9. Select Site and go to Properties.
  10. Click the Accounts tab and set it to use the proper account.
  11. Set to Basic Clear Text or Windows NT Challenge/Response as appropriate.

Managing Catalog Account:

The Administrative Access account in the Catalog Build Server is used to manage the catalog that is located on a different host or managing the configuration files. This account must have an administrative privileges. This account is also used when propagating the catalog to a different host.

1. Go to Site Server Management Console.
2. Select the Search snap-in.
3. Select Computer Name.
4. Select Catalog Build Server.
5. Go to the property of the catalog.
6. Click the Accounts tab.
7. Set the Administrative Access Account.

When you limit a search query based on user security context during file system crawl, the ACL (Access Control List) is fetched during catalog creation. On the other hand, when you limit search query result on an Exchange public folder, the ACL is fetched during the search time.