Microsoft-Windows-Search

258 events across 2 channels

Event ID	Title	Channel
1003		Operational
1003	The Windows Search Service started.	Application
1004		Operational
1004	The Windows Search service is creating the new search index {Reason: Full Index …	Application
1005		Operational
1005	The Windows Search Service has successfully created the new search index.	Application
1006		Operational
1007		Operational
1008		Operational
1008	The Windows Search Service is starting up and attempting to remove the old …	Application
1009		Operational
1010		Operational
1010	The Windows Search Service has successfully removed the old search index.	Application
1011		Operational
1013		Operational
1013	Windows Search Service stopped normally.	Application
1014		Operational
1015		Operational
1016		Operational
1017		Operational
1018		Operational
1019		Operational
1044		Operational
1053		Operational
3003		Operational
3006		Operational
3007		Operational
3008		Operational
3009		Operational
3010		Operational
3011		Operational
3013		Operational
3014		Operational
3015		Operational
3020		Operational
3023		Operational
3024		Operational
3025		Operational
3026		Operational
3027		Operational
3028		Operational
3029		Operational
3030		Operational
3031		Operational
3032		Operational
3033		Operational
3034		Operational
3036		Operational
3037		Operational
3038		Operational
3039		Operational
3040		Operational
3041		Operational
3042		Operational
3044		Operational
3045		Operational
3046		Operational
3048		Operational
3050		Operational
3052		Operational
3053		Operational
3054		Operational
3055		Operational
3056		Operational
3057		Operational
3058		Operational
3059		Operational
3060		Operational
3061		Operational
3062		Operational
3072		Operational
3073		Operational
3078		Operational
3079		Operational
3083		Operational
3084		Operational
3085		Operational
3086		Operational
3087		Operational
3088		Operational
3089		Operational
3090		Operational
3091		Operational
3092		Operational
3093		Operational
3095		Operational
3096		Operational
3097		Operational
3099		Operational
3100		Operational
3101		Operational
4103		Operational
4104		Operational
4105		Operational
4106		Operational
4121		Operational
4121		Application
4138		Operational
4163		Operational
4164		Operational
4165		Operational
4166		Operational
4167		Operational
4168		Operational
4169		Operational
7001		Operational
7010		Operational
7011		Operational
7013		Operational
7040		Operational
7042		Operational
7043		Operational
7064		Operational
7066		Operational
7068		Operational
7070		Operational
7071		Operational
9000		Operational
9001		Operational
9002		Operational
9003		Operational
10013		Operational
10014		Operational
10020		Operational
10021		Operational
10022		Operational
10023		Operational
10024		Operational
10024		Application
10025		Operational
10026		Operational
10027		Operational
10028		Operational
1073742827	The Windows Search Service started.	Operational
1073742828	The Windows Search service is creating the new search index {Reason: %2}.	Operational
1073742829	The Windows Search Service has successfully created the new search index.	Operational
1073742834	The Windows Search Service has successfully removed the old search index.	Operational
1073742837	Windows Search Service stopped normally.	Operational
1073742841	The Windows Search Service successfully moved index files from %2 to %3.	Operational
1073744865	The index is being reset.	Operational
1073744868	The gatherer index resumed.	Operational
1073744876	The crawl was requested to be stopped.	Operational
1073744884	An update cannot begin because the content source <.	Operational
1073744919	The group %2\%3 contains %4 members.	Operational
1073744920	The local groups cache was flushed, because %2.	Operational
1073745927	%1A master merge has completed for catalog %2.	Operational
1073745928	%1A master merge has been paused for catalog %2 due to error %3.	Operational
1073745945	%1A master merge has restarted for catalog %2.	Operational
1073745962	An index corruption was detected in component %2 in catalog %3.	Operational
1073745987	%1A master merge has been paused for catalog %2 due to low disk space.	Operational
1073745988	%1Catalog: %2.	Operational
1073745989	%1Catalog: %2.	Operational
1073745990	%1Catalog: %2.	Operational
1073745991	%1Catalog: %2.	Operational
1073748866	The Windows Search Service is being stopped because there is a problem with the …	Operational
2147484656	The Windows Search Service is starting up and attempting to remove the old …	Operational
2147484662	The Windows Search Service has failed to create one or more path rules.	Operational
2147484663	Event ID %2 for the Windows Search Service has been suppressed %3 time(s) since …	Operational
2147484666	While rolling back the index, the Windows Search Service encountered the …	Operational
2147484692	An error occurred in configuration file <.	Operational
2147484701	The system exception %1 occurred, and will be handled.	Operational
2147486671	The update cannot be started because all of the content sources were excluded by …	Operational
2147486672	The update cannot be started because the content sources cannot be accessed.	Operational
2147486684	Crawl could not be completed on content source <.	Operational
2147486685	Crawl could not be started on content source <.	Operational
2147486686	The gatherer is unable to read the registry %2.	Operational
2147486687	A request to start the update has been ignored because the update is already in …	Operational
2147486690	The index was paused.	Operational
2147486693	The automatic description length was adjusted from %2 to %3.	Operational
2147486694	The update for the index cannot be started because the specified content sources …	Operational
2147486701	The previous update was reset, or was otherwise interrupted.	Operational
2147486702	The update has been delayed because a disk is full.	Operational
2147486703	The gatherer property mapping file cannot be opened.	Operational
2147486704	The automatic description encoding tag value is invalid.	Operational
2147486709	The gatherer log cannot be created.	Operational
2147486710	The word breaker for language <.	Operational
2147486720	The gatherer is recovering after an improper shutdown.	Operational
2147486721	The gatherer detected pages in the history during recovery that cannot be read, …	Operational
2147486726	The Windows Search service stopped the Protocol Host process because it was …	Operational
2147486734	The system locale has changed.	Operational
2147487816	%1 Unable to create the query engine's first request item due to error %2.	Operational
2147487817	Error ID %2 happened in Windows Search recovery stage, please restart the …	Operational
2147492651	The Windows Search Service cannot initialize multi-instancing in Jet.	Operational
2147493661	The noise files cannot be renamed.	Operational
2147493662	The noise file ".	Operational
2147493668	Performance Counters could not be loaded for %1 for instance %2 %3 due to the …	Operational
2147493669	Could not get performance counter registry info for %1 for instance %2 %3 due to …	Operational
2147493670	Performance counters will not be loaded because the named objects (shared memory …	Operational
2147493671	The protocol host process %2 did not respond and is being forcibly terminated …	Operational
2147493672	The filter host process %2 did not respond and is being forcibly terminated.	Operational
2147493673	The search service has failed to create database instance for the index {.	Operational
2147493674	The search service has failed to configure maximum number of database instance.	Operational
2147493675	The search service has failed to create or load catalog for an user with SID {.	Operational
2147493676	The search service has failed to unload catalog for an user with SID {.	Operational
3221226478	The Windows Search Service has failed to create the new search index.	Operational
3221226479	The Windows Search Service was unable to allocate memory.	Operational
3221226481	An exception occurred in %2.	Operational
3221226483	The Windows Search Service has failed to remove the old search index.	Operational
3221226488	The Windows Search Service failed to move Index files from %2 to %3 with the …	Operational
3221226491	Windows Search Service failed to process the list of included and excluded …	Operational
3221228475	A configuration error occurred.	Operational
3221228478	Performance monitoring cannot be initialized for the gatherer service, because …	Operational
3221228479	Performance monitoring cannot be initialized for the gatherer object, because …	Operational
3221228480	The entry <.	Operational
3221228481	The transaction object cannot be created.	Operational
3221228482	The transaction cannot be appended to the queue.	Operational
3221228483	The transaction cannot be updated in the queue.	Operational
3221228485	The entry <.	Operational
3221228486	An exception occurred.	Operational
3221228487	The transaction file cannot be read.	Operational
3221228492	Internal gatherer error %2 occurred.	Operational
3221228497	Critical error %2 occurred, and the index was shut down.	Operational
3221228498	Advise Status Change failed.	Operational
3221228499	The URL <.	Operational
3221228500	The gatherer object cannot be initialized.	Operational
3221228501	The plug-in in <.	Operational
3221228502	The gatherer service cannot be initialized.	Operational
3221228503	A document ID cannot be allocated.	Operational
3221228504	A document ID cannot be freed.	Operational
3221228505	A new queue file cannot be created.	Operational
3221228506	The registry version does not match with the expected <.	Operational
3221228512	The status change request %2 cannot be processed.	Operational
3221228520	No documents were accessed because no e-mail address is specified in the content …	Operational
3221228522	Unvisited items cannot be deleted from the history after a full update.	Operational
3221228529	The plug-in manager <.	Operational
3221228530	The application cannot be initialized.	Operational
3221228531	The update cannot be initialized.	Operational
3221228551	Notifications for the volume %2 are not active.	Operational
3221228555	The protocol handler %2 cannot be loaded.	Operational
3221228556	Failed to load protocol handler %2.	Operational
3221228557	The application network access account is invalid.	Operational
3221228559	The gatherer files cannot be flushed, and this action cannot be completed.	Operational
3221228560	The checkpoint record cannot be updated, and this action cannot be completed.	Operational
3221228561	The gatherer files cannot be saved, and this action cannot be completed.	Operational
3221228562	The gatherer files from the previous checkpoint cannot be restored, and this …	Operational
3221228563	The checkpoint record cannot be read, and this action cannot be completed.	Operational
3221228564	The project cannot be initialized, because the checkpoint record cannot be read.	Operational
3221228565	The project cannot be initialized, because one of the checkpoint files is …	Operational
3221228569	The gatherer did not connect to the SQLServer instance.	Operational
3221228571	Unable to terminate notifications normally.	Operational
3221228572	Unable to initialize the filter host process.	Operational
3221228573	The filter host process could not be terminated.	Operational
3221229577	%1A master merge cannot be started for catalog %2 due to error %3.	Operational
3221229578	%1A master merge cannot be re-started for catalog %2 due to error %3.	Operational
3221232473	The schema file <.	Operational
3221232482	The index cannot be initialized.	Operational
3221232483	Directory location <.	Operational
3221232485	The update was paused because the disk <.	Operational
3221232512	The search service has detected corrupted data files in the index {id=.	Operational
3221232515	The index cannot be loaded.	Operational
3221232536	Performance monitoring cannot be initialized because the counters are not loaded …	Operational
3221232538	Configuration directory %2 is missing, and disaster recovery must be performed.	Operational
3221232540	The registry cannot be read, possibly because the registry keys for this index …	Operational
3221232542	The Windows Search Service added catalog %1.	Operational
3221232543	The Windows Search Service removed index %1.	Operational
3221234472	The Windows Search Service cannot open the Jet property store.	Operational
3221234473	The Windows Search Service cannot create a Jet property store.	Operational
3221234474	The Windows Search Service cannot load the property store information.	Operational

Event ID 1003 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 1003 — The Windows Search Service started.

Provider: Microsoft-Windows-Search
Channel: Application
Level: 4
Samples: 1

Fields

Name	Description
`Data`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 1003
  version: 0
  level: 4
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2023-11-06T06:25:51.885710+00:00'
  event_record_id: 1450
  correlation: {}
  execution:
    process_id: 5004
    thread_id: 0
  channel: Application
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  Data:
    Name: ExtraInfo
    Value: '

      '
message: The Windows Search Service started.ExtraInfo

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 1004 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 1004 — The Windows Search service is creating the new search index {Reason: Full Index Reset}.

Provider: Microsoft-Windows-Search
Channel: Application
Level: 4
Samples: 1

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 1004
  version: 0
  level: 4
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2023-11-06T06:25:51.187482+00:00'
  event_record_id: 1447
  correlation: {}
  execution:
    process_id: 5004
    thread_id: 0
  channel: Application
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  ExtraInfo: '

    '
  Reason: Full Index Reset
message: "The Windows Search service is creating the new search index {Reason: Full
  Index Reset}. \n"

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 1005 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 1005 — The Windows Search Service has successfully created the new search index.

Provider: Microsoft-Windows-Search
Channel: Application
Level: 4
Samples: 1

Fields

Name	Description
`Data`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 1005
  version: 0
  level: 4
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2023-11-06T06:25:51.828936+00:00'
  event_record_id: 1449
  correlation: {}
  execution:
    process_id: 5004
    thread_id: 0
  channel: Application
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  Data:
    Name: ExtraInfo
    Value: '

      '
message: The Windows Search Service has successfully created the new search index.
  ExtraInfo

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 1006 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—
`HR`	—
`DiagnosticsInfo`	—

Event ID 1007 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 1008 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 1008 — The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}.

Provider: Microsoft-Windows-Search
Channel: Application
Level: 3
Samples: 1

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 1008
  version: 0
  level: 3
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2023-11-06T06:25:47.791114+00:00'
  event_record_id: 1444
  correlation: {}
  execution:
    process_id: 5004
    thread_id: 0
  channel: Application
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  ExtraInfo: '

    '
  Reason: Full Index Reset
message: "The Windows Search Service is starting up and attempting to remove the old
  search index {Reason: Full Index Reset}. \n"

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 1009 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Address`	—

Event ID 1010 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 1010 — The Windows Search Service has successfully removed the old search index.

Provider: Microsoft-Windows-Search
Channel: Application
Level: 4
Samples: 1

Fields

Name	Description
`Data`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 1010
  version: 0
  level: 4
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2023-11-06T06:25:47.798155+00:00'
  event_record_id: 1445
  correlation: {}
  execution:
    process_id: 5004
    thread_id: 0
  channel: Application
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  Data:
    Name: ExtraInfo
    Value: '

      '
message: The Windows Search Service has successfully removed the old search index.
  ExtraInfo

References

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 1011 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—
`HR`	—

Event ID 1013 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 1013 — Windows Search Service stopped normally.

Provider: Microsoft-Windows-Search
Channel: Application
Level: 4
Samples: 1

Fields

Name	Description
`Data`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 1013
  version: 0
  level: 4
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2023-10-25T22:56:14.357450+00:00'
  event_record_id: 1432
  correlation: {}
  execution:
    process_id: 7916
    thread_id: 0
  channel: Application
  computer: WinDevEval
  security:
    user_id: ''
event_data:
  Data:
    Name: ExtraInfo
    Value: '

      '
message: Windows Search Service stopped normally.ExtraInfo

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1014 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`DebugInfo`	—

Event ID 1015 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`EventID`	—
`RepeatCount`	—
`ReferenceTime`	—

Event ID 1016 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`OldIndexPath`	—
`NewIndexPath`	—
`Phase`	—
`ErrorCode`	—

Event ID 1017 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`OldIndexPath`	—
`NewIndexPath`	—

Event ID 1018 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`OldIndexPath`	—
`NewIndexPath`	—
`Phase`	—
`ErrorCode`	—

Event ID 1019 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—
`ErrorCode`	—
`Path`	—

Event ID 1044 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`FileName`	—

Event ID 1053 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`Code`	—
`StackTrace`	—

Event ID 3003 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3006 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3007 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3008 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Entry`	—

Event ID 3009 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3010 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`FilePath`	—

Event ID 3011 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`FilePath`	—

Event ID 3013 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Entry`	—

Event ID 3014 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ID`	—

Event ID 3015 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3020 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ErrorCode`	—

Event ID 3023 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3024 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3025 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ErrorCode`	—

Event ID 3026 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3027 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 3028 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3029 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Plugin`	—

Event ID 3030 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3031 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3032 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3033 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3034 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ExpectedVersion`	—

Event ID 3036 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 3037 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 3038 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`RegPath`	—

Event ID 3039 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3040 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`RequestedStatusMessage`	—

Event ID 3041 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3042 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3044 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3045 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`OldLength`	—
`NewLength`	—

Event ID 3046 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3048 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3050 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3052 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3053 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3054 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3055 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3056 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3057 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`PluginManager`	—

Event ID 3058 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3059 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3060 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 3061 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3062 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Locale`	—

Event ID 3072 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3073 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3078 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3079 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`VolumeName`	—

Event ID 3083 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ProtocolHandler`	—
`ErrorMessage`	—

Event ID 3084 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ProtocolHandler`	—
`ErrorMessage`	—

Event ID 3085 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3086 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3087 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3088 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3089 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3090 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3091 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3092 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3093 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3095 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Domain`	—
`Account`	—
`Users`	—
`MaxUsers`	—

Event ID 3096 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 3097 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3099 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3100 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 3101 —

Provider: Microsoft-Windows-Search
Channel: Operational

Event ID 4103 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Event ID 4104 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`ErrorMessage`	—

Event ID 4105 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`ErrorMessage`	—

Event ID 4106 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`ErrorMessage`	—

Event ID 4121 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Event ID 4121 —

Provider: Microsoft-Windows-Search
Channel: Application
Level: 4
Samples: 1

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 4121
  version: 0
  level: 4
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2014-11-26T23:22:14.000000Z'
  event_record_id: 1157
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: IE10Win7
  security:
    user_id: ''
event_data:
  ExtraInfo: '

    '
  CatalogName: SystemIndex

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4138 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Component`	—
`CatalogName`	—

Event ID 4163 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Event ID 4164 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Event ID 4165 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`IndexesPerMergeLevel`	—
`__binLength`	—
`binary`	—

Event ID 4166 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`ExpectedDocCount`	—
`__binLength`	—
`binary`	—

Event ID 4167 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`MasterMergeReason`	—
`__binLength`	—
`binary`	—

Event ID 4168 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ErrorMessage`	—
`__binLength`	—
`binary`	—

Event ID 4169 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—

Event ID 7001 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`SrcFile`	—
`DstFile`	—

Event ID 7010 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 7011 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Directory`	—

Event ID 7013 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Directory`	—

Event ID 7040 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`CorruptionId`	—

Event ID 7042 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 7043 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 7064 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 7066 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`Directory`	—

Event ID 7068 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 7070 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 7071 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 9000 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 9001 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 9002 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 9003 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 10013 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 10014 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`OldNoiseFile`	—
`NewNoiseFile`	—

Event ID 10020 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`Driver`	—
`InstanceName`	—
`InstanceNum`	—
`ErrorMessage`	—

Event ID 10021 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`Driver`	—
`InstanceName`	—
`InstanceNum`	—
`ErrorMessage`	—

Event ID 10022 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`Driver`	—
`InstanceName`	—
`InstanceNum`	—

Event ID 10023 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`ProtocolHostProcessID`	—
`FilterHostProcessID`	—

Event ID 10024 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`FilterHostProcessID`	—

Event ID 10024 —

Provider: Microsoft-Windows-Search
Channel: Application
Level: 3
Samples: 1

Fields

Name	Description
`ExtraInfo`	—
`FilterHostProcessID`	—

Example Event

system:
  provider: Microsoft-Windows-Search
  guid: '{CA4E628D-8567-4896-AB6B-835B221F373F}'
  event_source_name: Windows Search Service
  event_id: 10024
  version: 0
  level: 3
  task: 3
  opcode: 0
  keywords: 36028797018963968
  time_created: '2014-11-25T22:48:11.000000Z'
  event_record_id: 1044
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: Application
  computer: IE8Win7
  security:
    user_id: ''
event_data:
  ExtraInfo: '

    '
  FilterHostProcessID: '4008'

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 10025 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 10026 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—

Event ID 10027 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`SID`	—

Event ID 10028 —

Provider: Microsoft-Windows-Search
Channel: Operational

Fields

Name	Description
`ExtraInfo`	—
`SID`	—

Event ID 1073742827 — The Windows Search Service started.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service started.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 1073742828 — The Windows Search service is creating the new search index {Reason: %2}.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search service is creating the new search index {Reason: %2}. %1

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 1073742829 — The Windows Search Service has successfully created the new search index.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service has successfully created the new search index. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 1073742834 — The Windows Search Service has successfully removed the old search index.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service has successfully removed the old search index. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 1073742837 — Windows Search Service stopped normally.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Windows Search Service stopped normally.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 1073742841 — The Windows Search Service successfully moved index files from %2 to %3.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service successfully moved index files from %2 to %3. %1

Fields

Name	Description
`ExtraInfo`	—
`OldIndexPath`	—
`NewIndexPath`	—

Event ID 1073744865 — The index is being reset.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The index is being reset.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 1073744868 — The gatherer index resumed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer index resumed.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 1073744876 — The crawl was requested to be stopped.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The crawl was requested to be stopped.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 1073744884 — An update cannot begin because the content source <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

An update cannot begin because the content source <%2> is in use by another update already in progress. The update will start as soon as all its content sources are released by updates already in progress.%1

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 1073744919 — The group %2\%3 contains %4 members.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The group %2\%3 contains %4 members. Groups over %5 members are not expanded. %1

Fields

Name	Description
`ExtraInfo`	—
`Domain`	—
`Account`	—
`Users`	—
`MaxUsers`	—

Event ID 1073744920 — The local groups cache was flushed, because %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The local groups cache was flushed, because %2. %1

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 1073745927 — %1A master merge has completed for catalog %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1A master merge has completed for catalog %2.

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Event ID 1073745928 — %1A master merge has been paused for catalog %2 due to error %3.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1A master merge has been paused for catalog %2 due to error %3. It will be rescheduled later.

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`ErrorMessage`	—

Event ID 1073745945 — %1A master merge has restarted for catalog %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1A master merge has restarted for catalog %2.

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Event ID 1073745962 — An index corruption was detected in component %2 in catalog %3.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

An index corruption was detected in component %2 in catalog %3.%1

Fields

Name	Description
`ExtraInfo`	—
`Component`	—
`CatalogName`	—

Event ID 1073745987 — %1A master merge has been paused for catalog %2 due to low disk space.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1A master merge has been paused for catalog %2 due to low disk space. The merge will be rescheduled later.  Please free some disk space for indexing to continue.

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—

Event ID 1073745988 — %1Catalog: %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1Catalog: %2. A master merge was started due to an external request.

Fields

Name	Description
`1Catalog`	—
`ExtraInfo`	—
`CatalogName`	—

Event ID 1073745989 — %1Catalog: %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1Catalog: %2. A master merge was started because the catalog reached the maximum number of indexes on the last level (%3).

Fields

Name	Description
`1Catalog`	—
`ExtraInfo`	—
`CatalogName`	—
`IndexesPerMergeLevel`	—
`binary`	—

Event ID 1073745990 — %1Catalog: %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1Catalog: %2. A master merge was started because the expected number of documents in the catalog (%3) were indexed.

Fields

Name	Description
`1Catalog`	—
`ExtraInfo`	—
`CatalogName`	—
`ExpectedDocCount`	—
`binary`	—

Event ID 1073745991 — %1Catalog: %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1Catalog: %2. The master merge was started because of internal reason number %3.

Fields

Name	Description
`1Catalog`	—
`ExtraInfo`	—
`CatalogName`	—
`MasterMergeReason`	—
`binary`	—

Event ID 1073748866 — The Windows Search Service is being stopped because there is a problem with the indexer.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service is being stopped because there is a problem with the indexer: %2.%1

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 2147484656 — The Windows Search Service is starting up and attempting to remove the old search index {Reason: %2}.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service is starting up and attempting to remove the old search index {Reason: %2}. %1

Fields

Name	Description
`ExtraInfo`	—
`Reason`	—

Event ID 2147484662 — The Windows Search Service has failed to create one or more path rules.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service has failed to create one or more path rules.  The service will continue creating the SystemIndex search index.  Debug information: <%2>. %1

Fields

Name	Description
`ExtraInfo`	—
`DebugInfo`	—

Event ID 2147484663 — Event ID %2 for the Windows Search Service has been suppressed %3 time(s) since %4.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Event ID %2 for the Windows Search Service has been suppressed %3 time(s) since %4. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time.  See Event ID %2 for further details on this event.%1

Fields

Name	Description
`ExtraInfo`	—
`EventID`	—
`RepeatCount`	—
`ReferenceTime`	—

Event ID 2147484666 — While rolling back the index, the Windows Search Service encountered the following error: <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

While rolling back the index, the Windows Search Service encountered the following error: <%4,%5>. Index files were not moved from %2 to %3. %1

Fields

Name	Description
`ExtraInfo`	—
`OldIndexPath`	—
`NewIndexPath`	—
`Phase`	—
`ErrorCode`	—

Event ID 2147484692 — An error occurred in configuration file <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

An error occurred in configuration file <%2>.%1

Fields

Name	Description
`ExtraInfo`	—
`FileName`	—

Event ID 2147484701 — The system exception %1 occurred, and will be handled.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The system exception %1 occurred, and will be handled.  If this causes problems, contact Microsoft Product Support Services and include the stack trace in the event. %2.

Fields

Name	Description
`Code`	—
`StackTrace`	—

Event ID 2147486671 — The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486672 — The update cannot be started because the content sources cannot be accessed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486684 — Crawl could not be completed on content source <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Crawl could not be completed on content source <%2>.%1

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 2147486685 — Crawl could not be started on content source <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Crawl could not be started on content source <%2>.%1

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 2147486686 — The gatherer is unable to read the registry %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer is unable to read the registry %2.%1

Fields

Name	Description
`ExtraInfo`	—
`RegPath`	—

Event ID 2147486687 — A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486690 — The index was paused.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The index was paused.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486693 — The automatic description length was adjusted from %2 to %3.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The automatic description length was adjusted from %2 to %3.%1

Fields

Name	Description
`ExtraInfo`	—
`OldLength`	—
`NewLength`	—

Event ID 2147486694 — The update for the index cannot be started because the specified content sources were not configured for updates.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The update for the index cannot be started because the specified content sources were not configured for updates. Add at least one content source.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486701 — The previous update was reset, or was otherwise interrupted.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The previous update was reset, or was otherwise interrupted. A full update of all content sources will be automatically started. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486702 — The update has been delayed because a disk is full.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The update has been delayed because a disk is full. Check the system default temp location and the drive on which search catalog is created. The system default temp location is used for creation of temporary files during crawling. If it is full, crawling pauses. If the system default temp location is full, change the location to a disk with more free space and restart the computer. Changes to the system temp location do not take effect for system services until the computer is restarted.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486703 — The gatherer property mapping file cannot be opened.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer property mapping file cannot be opened. The default values are being used. You may have to copy the property mapping file from the setup CD, or reinstall the application.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486704 — The automatic description encoding tag value is invalid.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The automatic description encoding tag value is invalid. The gatherer is setting this value to "yes"". Fix the gthrprm.txt file.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486709 — The gatherer log cannot be created.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer log cannot be created.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486710 — The word breaker for language <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The word breaker for language <%2> cannot be loaded.%1

Fields

Name	Description
`ExtraInfo`	—
`Locale`	—

Event ID 2147486720 — The gatherer is recovering after an improper shutdown.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer is recovering after an improper shutdown.  This will delay availability of gathering functions, and may result in some noncritical data loss.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486721 — The gatherer detected pages in the history during recovery that cannot be read, and repaired them.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer detected pages in the history during recovery that cannot be read, and repaired them.  However, statistical data for some URLs may have been lost.  This can be caused by restarting a computer without first shutting down Windows, or by disk failure.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486726 — The Windows Search service stopped the Protocol Host process because it was consuming too many resources.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search service stopped the Protocol Host process because it was consuming too many resources.  A new Protocol Host process will be started.  No user action is required.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147486734 — The system locale has changed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The system locale has changed. Existing data will be deleted and the index must be recreated.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147487816 — %1 Unable to create the query engine's first request item due to error %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1 Unable to create the query engine's first request item due to error %2. It's possible that the MSFTESQL service account is invalid or the password has expired.

Fields

Name	Description
`ExtraInfo`	—
`ErrorMessage`	—
`binary`	—

Event ID 2147487817 — Error ID %2 happened in Windows Search recovery stage, please restart the service.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Error ID %2 happened in Windows Search recovery stage, please restart the service. If this error persists, please recreate the index.%1

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—

Event ID 2147492651 — The Windows Search Service cannot initialize multi-instancing in Jet.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service cannot initialize multi-instancing in Jet. If the application is used in a cluster environment, all applications using Jet will fail in the same group.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147493661 — The noise files cannot be renamed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The noise files cannot be renamed.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147493662 — The noise file ".

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The noise file "%2"" cannot be renamed to ""%3"".%1

Fields

Name	Description
`ExtraInfo`	—
`OldNoiseFile`	—
`NewNoiseFile`	—

Event ID 2147493668 — Performance Counters could not be loaded for %1 for instance %2 %3 due to the following error: %4.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Performance Counters could not be loaded for %1 for instance %2 %3 due to the following error: %4.

Fields

Name	Description
`Driver`	—
`InstanceName`	—
`InstanceNum`	—
`ErrorMessage`	—

Event ID 2147493669 — Could not get performance counter registry info for %1 for instance %2 %3 due to the following error: %4.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Could not get performance counter registry info for %1 for instance %2 %3 due to the following error: %4.

Fields

Name	Description
`Driver`	—
`InstanceName`	—
`InstanceNum`	—
`ErrorMessage`	—

Event ID 2147493670 — Performance counters will not be loaded because the named objects (shared memory or events) are in use for %1 for instance %2 %3.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Performance counters will not be loaded because the named objects (shared memory or events) are in use for %1 for instance %2 %3.

Fields

Name	Description
`Driver`	—
`InstanceName`	—
`InstanceNum`	—

Event ID 2147493671 — The protocol host process %2 did not respond and is being forcibly terminated {filter host process %3}.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The protocol host process %2 did not respond and is being forcibly terminated {filter host process %3}. %1

Fields

Name	Description
`ExtraInfo`	—
`ProtocolHostProcessID`	—
`FilterHostProcessID`	—

Event ID 2147493672 — The filter host process %2 did not respond and is being forcibly terminated.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The filter host process %2 did not respond and is being forcibly terminated. %1

Fields

Name	Description
`ExtraInfo`	—
`FilterHostProcessID`	—

Event ID 2147493673 — The search service has failed to create database instance for the index {.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The search service has failed to create database instance for the index {%1} due to maximum number of instance reached. Please re-configure maximum value and restart the service.

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147493674 — The search service has failed to configure maximum number of database instance.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The search service has failed to configure maximum number of database instance. {%1}. Please re-configure maximum value and restart the service.

Fields

Name	Description
`ExtraInfo`	—

Event ID 2147493675 — The search service has failed to create or load catalog for an user with SID {.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The search service has failed to create or load catalog for an user with SID {%2}. Please inspect a profile directory for the user is accessible. You should re-start the search service after fixing any issue found from the profile directory. %1

Fields

Name	Description
`ExtraInfo`	—
`SID`	—

Event ID 2147493676 — The search service has failed to unload catalog for an user with SID {.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The search service has failed to unload catalog for an user with SID {%2}. %1

Fields

Name	Description
`ExtraInfo`	—
`SID`	—

Event ID 3221226478 — The Windows Search Service has failed to create the new search index.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service has failed to create the new search index. Internal error <%2, %3, %4>. %1

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—
`HR`	—
`DiagnosticsInfo`	—

Event ID 3221226479 — The Windows Search Service was unable to allocate memory.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service was unable to allocate memory.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221226481 — An exception occurred in %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

An exception occurred in %2. Check other related Event Log messages.%1

Fields

Name	Description
`ExtraInfo`	—
`Address`	—

Event ID 3221226483 — The Windows Search Service has failed to remove the old search index.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service has failed to remove the old search index. Internal error <%2,%3>. %1

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—
`HR`	—

Event ID 3221226488 — The Windows Search Service failed to move Index files from %2 to %3 with the following error: <%4,%5>.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service failed to move Index files from %2 to %3 with the following error: <%4,%5>. This might be because the target directory is not empty, or because the SYSTEM account doesn't have write access to the target directory. %1

Fields

Name	Description
`ExtraInfo`	—
`OldIndexPath`	—
`NewIndexPath`	—
`Phase`	—
`ErrorCode`	—

Event ID 3221226491 — Windows Search Service failed to process the list of included and excluded locations with the error <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Windows Search Service failed to process the list of included and excluded locations with the error <%2, %3, "%4">. %1

Fields

Name	Description
`ExtraInfo`	—
`Phase`	—
`ErrorCode`	—
`Path`	—

Event ID 3221228475 — A configuration error occurred.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

A configuration error occurred.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228478 — Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be op...

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228479 — Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be ope...

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228480 — The entry <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The entry <%2> cannot be inserted into the history.%1

Fields

Name	Description
`ExtraInfo`	—
`Entry`	—

Event ID 3221228481 — The transaction object cannot be created.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The transaction object cannot be created.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228482 — The transaction cannot be appended to the queue.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The transaction cannot be appended to the queue. File: %2.%1

Fields

Name	Description
`ExtraInfo`	—
`FilePath`	—

Event ID 3221228483 — The transaction cannot be updated in the queue.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The transaction cannot be updated in the queue. File: %2.%1

Fields

Name	Description
`ExtraInfo`	—
`FilePath`	—

Event ID 3221228485 — The entry <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The entry <%2> in the hash map cannot be updated.%1

Fields

Name	Description
`ExtraInfo`	—
`Entry`	—

Event ID 3221228486 — An exception occurred.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

An exception occurred. ID: %2. This is an internal error. Reproduce the error with the debugger attached and enable exceptions, then contact product support. One of the components loaded in your system is bad. You may be able to avoid the problem by recreating the index.%1

Fields

Name	Description
`ExtraInfo`	—
`ID`	—

Event ID 3221228487 — The transaction file cannot be read.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The transaction file cannot be read.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228492 — Internal gatherer error %2 occurred.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Internal gatherer error %2 occurred. Please contact Microsoft Product Support Services.%1

Fields

Name	Description
`ExtraInfo`	—
`ErrorCode`	—

Event ID 3221228497 — Critical error %2 occurred, and the index was shut down.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Critical error %2 occurred, and the index was shut down. The system is probably low on resources. Free up resources and restart the service.%1

Fields

Name	Description
`ExtraInfo`	—
`ErrorCode`	—

Event ID 3221228498 — Advise Status Change failed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Advise Status Change failed. The system is probably low on resources. Free up resources and restart the service.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228499 — The URL <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The URL <%2> cannot be crawled.%1

Fields

Name	Description
`ExtraInfo`	—
`URL`	—

Event ID 3221228500 — The gatherer object cannot be initialized.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer object cannot be initialized.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228501 — The plug-in in <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The plug-in in <%2> cannot be initialized.%1

Fields

Name	Description
`ExtraInfo`	—
`Plugin`	—

Event ID 3221228502 — The gatherer service cannot be initialized.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer service cannot be initialized.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228503 — A document ID cannot be allocated.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

A document ID cannot be allocated.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228504 — A document ID cannot be freed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

A document ID cannot be freed.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228505 — A new queue file cannot be created.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

A new queue file cannot be created.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228506 — The registry version does not match with the expected <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The registry version does not match with the expected <%2>, or the registry cannot be accessed because the service account does not have the correct permissions.  Uninstall the previous version before installing the new one.%1

Fields

Name	Description
`ExtraInfo`	—
`ExpectedVersion`	—

Event ID 3221228512 — The status change request %2 cannot be processed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The status change request %2 cannot be processed.%1

Fields

Name	Description
`ExtraInfo`	—
`RequestedStatusMessage`	—

Event ID 3221228520 — No documents were accessed because no e-mail address is specified in the content index server properties.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

No documents were accessed because no e-mail address is specified in the content index server properties. Specify the e-mail address in the service configuration.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228522 — Unvisited items cannot be deleted from the history after a full update.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Unvisited items cannot be deleted from the history after a full update.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228529 — The plug-in manager <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The plug-in manager <%2> cannot be initialized.%1

Fields

Name	Description
`ExtraInfo`	—
`PluginManager`	—

Event ID 3221228530 — The application cannot be initialized.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The application cannot be initialized.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228531 — The update cannot be initialized.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The update cannot be initialized.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228551 — Notifications for the volume %2 are not active.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Notifications for the volume %2 are not active. %1

Fields

Name	Description
`ExtraInfo`	—
`VolumeName`	—

Event ID 3221228555 — The protocol handler %2 cannot be loaded.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The protocol handler %2 cannot be loaded. Error description: %3. %1

Fields

Name	Description
`ExtraInfo`	—
`ProtocolHandler`	—
`ErrorMessage`	—

Event ID 3221228556 — Failed to load protocol handler %2.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Failed to load protocol handler %2. Error description: %3. %1

Fields

Name	Description
`ExtraInfo`	—
`ProtocolHandler`	—
`ErrorMessage`	—

Event ID 3221228557 — The application network access account is invalid.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The application network access account is invalid.  Update the account with a valid username and password. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228559 — The gatherer files cannot be flushed, and this action cannot be completed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer files cannot be flushed, and this action cannot be completed. The gatherer will attempt to flush files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228560 — The checkpoint record cannot be updated, and this action cannot be completed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The checkpoint record cannot be updated, and this action cannot be completed. The gatherer will attempt to update the checkpoint record again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228561 — The gatherer files cannot be saved, and this action cannot be completed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer files cannot be saved, and this action cannot be completed. The gatherer will attempt to save the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228562 — The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed. The gatherer will attempt to restore the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228563 — The checkpoint record cannot be read, and this action cannot be completed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The checkpoint record cannot be read, and this action cannot be completed.  If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228564 — The project cannot be initialized, because the checkpoint record cannot be read.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The project cannot be initialized, because the checkpoint record cannot be read. The data structures on the disk will be reset.  Verify that your hardware is working properly. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228565 — The project cannot be initialized, because one of the checkpoint files is missing.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The project cannot be initialized, because one of the checkpoint files is missing. The data structures on the disk will be reset.  Check to see if someone is manually deleting files, and verify that your hardware is working properly. %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228569 — The gatherer did not connect to the SQLServer instance.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The gatherer did not connect to the SQLServer instance.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228571 — Unable to terminate notifications normally.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Unable to terminate notifications normally.  Restart the service or contact Product Support.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228572 — Unable to initialize the filter host process.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Unable to initialize the filter host process. Terminating.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221228573 — The filter host process could not be terminated.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The filter host process could not be terminated.

Event ID 3221229577 — %1A master merge cannot be started for catalog %2 due to error %3.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1A master merge cannot be started for catalog %2 due to error %3.

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`ErrorMessage`	—

Event ID 3221229578 — %1A master merge cannot be re-started for catalog %2 due to error %3.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

%1A master merge cannot be re-started for catalog %2 due to error %3.

Fields

Name	Description
`ExtraInfo`	—
`CatalogName`	—
`ErrorMessage`	—

Event ID 3221232473 — The schema file <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The schema file <%2> cannot be copied to <%3>.%1

Fields

Name	Description
`ExtraInfo`	—
`SrcFile`	—
`DstFile`	—

Event ID 3221232482 — The index cannot be initialized.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The index cannot be initialized.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221232483 — Directory location <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Directory location <%2> is invalid. The application configuration cannot be read.  Reinstall the application.%1

Fields

Name	Description
`ExtraInfo`	—
`Directory`	—

Event ID 3221232485 — The update was paused because the disk <.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The update was paused because the disk <%2> is full. Free up disk space to continue crawling the index.%1

Fields

Name	Description
`ExtraInfo`	—
`Directory`	—

Event ID 3221232512 — The search service has detected corrupted data files in the index {id=.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The search service has detected corrupted data files in the index {id=%2}. The service will attempt to automatically correct this problem by rebuilding the index.%1

Fields

Name	Description
`ExtraInfo`	—
`CorruptionId`	—

Event ID 3221232515 — The index cannot be loaded.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The index cannot be loaded.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221232536 — Performance monitoring cannot be initialized because the counters are not loaded or the shared memory object cannot be opened.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Performance monitoring cannot be initialized because the counters are not loaded or the shared memory object cannot be opened. Stop and restart the search service.  If this error continues, reinstall the application.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221232538 — Configuration directory %2 is missing, and disaster recovery must be performed.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

Configuration directory %2 is missing, and disaster recovery must be performed. If there are existing indexes, they must be restored from the last backup. If there is no backup of index data, then delete the catalogs and recreate them.%1

Fields

Name	Description
`ExtraInfo`	—
`Directory`	—

Event ID 3221232540 — The registry cannot be read, possibly because the registry keys for this index are missing.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The registry cannot be read, possibly because the registry keys for this index are missing. You may have to delete and recreate the index %1.

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221232542 — The Windows Search Service added catalog %1.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service added catalog %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221232543 — The Windows Search Service removed index %1.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service removed index %1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221234472 — The Windows Search Service cannot open the Jet property store.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service cannot open the Jet property store.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221234473 — The Windows Search Service cannot create a Jet property store.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service cannot create a Jet property store.%1

Fields

Name	Description
`ExtraInfo`	—

Event ID 3221234474 — The Windows Search Service cannot load the property store information.

Provider: Microsoft-Windows-Search
Channel: Operational

Message

The Windows Search Service cannot load the property store information.%1

Fields

Name	Description
`ExtraInfo`	—