How to cleanly remove a search security trimmer (ISecurityTrimmer2)

Question

I created a very simple implementation of ISecurityTrimmer2 in SharePoint 2010. Registered it, and everything worked as expected.

I removed it using the following PowerShell:

$searchApp = Get-SPEnterpriseSearchServiceApplication "Search Service Application"
$trimmer = $searchApp | Get-SPEnterpriseSearchSecurityTrimmer
$trimmer | Remove-SPEnterpriseSearchSecurityTrimmer -SearchApplication "Search Service Application"

Powershell warns me that it's ignoring the extra parameter -SearchApplication, but the command doesn't work without it. I have verified that Get-SPEnterpriseSecurityTrimmer returns no results.

I am now getting no search results, with the following error in the ULS from the Query Processor:

Error occurred when executing pluggable security trimmer with Id 1 System.InvalidOperationException: Could not find Pluggable Security Trimmer with Id '1'.    
 at Microsoft.Office.Server.Search.Administration.Security.PluggableSecurityTrimmerManager.Instantiate(Int32 idRequested)    
 at Microsoft.Office.Server.Search.Administration.Security.PluggableSecurityTrimmerManager.GetPluggableSecurityTrimmer(Int32 id)    
 at Microsoft.Office.Server.Search.Query.PluggableSecurityTrimmer.Trim(UInt32[] docIds, Boolean[] displayDoc, UInt32 oldScannedCount, UInt32 logicalStartPosition, UInt32 desiredResultCount)

I've done iisreset and still get the same error. Obviously it's not there, but why is the Query Processor still looking for it and how can I fully remove it?

Answer 1

Apparently doing a new full crawl fixes it.

I found an explanation in the comments on this article about 2013 Post trimmers by Sveinar Rasmussen

The reason for the initial full crawl is that the content objects (documents) need to be associated with the registered trimmer. It will put an integer ID on those that match the crawl rule. Once the content is "marked up" with a post-trimmer, the post-trimmer is invoked. And any subsequent changes to the trimmer logic will not require any crawls after that, as long as you aren't re-registering trimmers.

In my experience, if you want to do something that invovles changing the strong name of the security trimmer (e.g. changing the assembly version), you can remove it and re-add it with the same ID without requiring a full crawl. On 2013 only, this also needs a restart of the Search Host Controller service.