SharePoint Search Crawls - Access denied errors after service account password change

Dear @Dull Pretty,

Thank you for your question. After a service account password change, "access denied" errors on search crawls are a known issue that typically arises from not updating the credentials in all required locations. Updating only the default content access account in Central Administration is often the primary fix, but I understand your concern about other dependencies. Here is the full list of places to validate and update.

This is the main account the search service uses for crawling and is the most common point of failure. You must update it via one of these methods:

1. Central Administration: Navigate to Application Management > Manage Service Applications. Select your Search Service Application. On the Search Administration page, in the System Status section, click the name of the Default Content Access Account and enter the new password. Please refer to this document: Item was not crawled because of a password change. Update password and retry crawling | Microsoft L… 
2. PowerShell: Use the Set-SPEnterpriseSearchServiceApplication cmdlet. You can find a detailed example in the official documentation. Please refer this document: Set-SPEnterpriseSearchServiceApplication (Microsoft.SharePoint.Powershell) | Microsoft Learn

While the above is the most critical step, you should confirm these additional areas to ensure a comprehensive fix:

• Crawl Rules: If you have specific crawl rules configured to use a different content access account for certain URLs, those individual accounts will need their passwords updated directly in the crawl rule properties. Please refer to this document: Change the default account for crawling in SharePoint Server - SharePoint Server | Microsoft Learn
• Service Account for the Search Service: It is a good practice to verify that the password for the service account running the SharePoint Search service itself is current. This can be updated using the Set-SPEnterpriseSearchService PowerShell cmdlet with the -ServiceAccount and -ServicePassword parameters. Please refer to this document: Set-SPEnterpriseSearchService (Microsoft.SharePoint.Powershell) | Microsoft Learn

After updating, I recommend the following approach to ensure the problem is fully resolved:

1. Check Web Application Policy: Grant the default content access account "Full Read" permission on the web applications being crawled via the User Policy in Central Administration.
2. Run a Test Crawl: Instead of a full crawl, start by running a crawl on a single, small content source to confirm the authentication is now successful.
3. Check Crawl Logs: If the error persists, review the crawl logs for specific URLs. This will help you identify if a specific crawl rule or an unexpected permission issue is involved.

I hope this checklist helps you resolve the issue efficiently. Please let me know if the problem continues after you've verified these points.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.