0

I have upgraded from Windows Server 2008 R2 x64 to Windows Server 2012 R2 x64. In previous installation I had some issues with Windows Search after Security Roll-up (January or February 2020). It started to hang up till restarted. I've wrote a script and added it to Planner to start one time per night. After system upgrade problem occurred. Been solving it for a week already. What has been done:

  1. reinstalled role Windows Search
  2. cleaned registry path HKLM\Software\Microsoft\Windows Search
  3. index rebuild
  4. tons of registry tweaks like CoreCount = 1 and so on.

Problem didn't solved.

I've started SysInternals ProcessMon and filtered access to registry path and got some errors:

High Resolution Date & Time:    28.05.2020 14:11:17,9562745
Event Class:    Registry
Operation:  RegQueryValue
Result: BUFFER OVERFLOW
Path:   HKLM\SOFTWARE\Microsoft\Windows Search\CrawlScopeManager\Windows\SystemIndex\DefaultRules\0\URL
TID:    17260
Duration:   0.0000116
Length: 144

enter image description here

It's usual path for crawler containing path for user to exclude - file:///C:[516392d7-8e63-47db-b92c-872191c3cd72]\Users\someuser\AppData\

Found some February CVE corresponding to BufferOverflow in IE Search, but they been fixed by security roll-ups in March 2020.

Current system been updated with all updates including latest May Security Rollup (May 12, 2020—KB4556846).

I don't have any idea what to do next.

  • I assume you have uninstall the suspect updates to confirm the updates are the source of this behavior? This would at least confirm the issue is with the update and not due to some other configuration change that happened without your knowledge. You mention the March roll-ups but don't specifically indicate if you have installed it, and since it was released a month ago, I am left thinking this could have been fixed in the April or May update. – Ramhound May 28 at 12:17
  • After server upgrade to Windows 2012R2 I've installed all updates it's found. There was about 3 GBs of them including latest May 12, 2020—KB4556846 (Monthly Rollup). – Andy Shu May 28 at 12:26
  • How many active users are there on this server? Does it have Active Directory? How many users are connected at any given moment (like, right now, for example)? If several users access the same directory or shared folder at the same time, and open, edit, then save and close the same files (say, Excel files, for example), indexing, thus search, can take a long time to adjust. You can reduce the number of shadow copies in user-accessible directories to see if it helps. Go to Server Management, under Tools, select VSS (Volume Snapshot Service) and edit properties for the disk in question. – user1019780 May 28 at 14:14
  • Server is not in domain. There are about 30 active users at one time using MS Office: Excel, Word and Outlook. I've tried to open VSS settings but it said Class not registered. error 0x80040154 :( Hmm... – Andy Shu May 28 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.