Search Service App Pool will not stay running sharepoint 2013

Question

I configured search on a separate app server. Everything went well but the app pool wouldn't stay running. I got the following error in the event viewer:

Application pool decef64cb5444595a2545b4739a42fbe has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool.

When I tried to access the search admin page, it displays the following at the top of the page:

Administrative status The remote server returned an error: (503) Server Unavailable.

I am using a domain account to run the service: sp_search

I finally added the sp_search account to the local computer admin group and it worked. I didn't think an application pool service account needed to be in the local admin group.

Any ideas?

Edit: it appears my service app pool account has the same issue. It works only when it is a local admin on the server.

I also tried adding the accounts to the GP "log on as service" and "log on as batch job" settings, but it still didn't work.

Answer 1

Form my previous experience, SharePoint Search service account(sp_search in your case) needs to be added to Local admin group when you are configuring search and after configuration, it can be removed from local admin group.

This setup is not required for other Service accounts(except User Profile service which also requires a admin access when configuring).

Log on as batch job permission is required for accounts that run as Application pool account. Log on as service permission is required for accounts that run as Windows service account (such as Timer job service, Search service). Also, all the accounts need to be part of Performance Log users and Performance Monitor Users group. Some things to check: 1. Check if the service accounts are part of WSS_WPG group. 2. Check if the Security Token service is running without errors 3. Check for registry access errors by using the Proc Mon tool (Process Monitor). This will tell if any account is denied Registry read/write access.