I have setup a new SP2016 single server installation for test purpose. Regardless the best practice, I use the setup account as the crawl account for my Search Service Application.

After first time full crawl, it return the "Access is denied. Verify that either the Default Content Access Account has access ..." error. I checked the web application user policy and it has full read. I tried login within server and success browse to all pages. In crawl log, it returns 1 error and 750 success. The 750 success are the 750 users's mysite. The 1 error is http://servername. I only have 1 web application and 1 site collection http://servername.

I tested search with "People" scope result is correct. However none is returned for "everything" scope.

I have also:

  • Change registry for DisableLoopBackCheck and BackConnectionHostNames
  • add the default content access account to web application's user policy with "ALL READ"
  • within the server (win2016), I opened IE and login with default content access account, I can browse all SharePoint pages without issue
  • delete and recreate search service application
  • click on search service application > administrator > grant Full control to the default content account
  • try to switch authentication method between NTLM and Kerberos (both have same error "Access is denied ...")
  • Use GrantAccessToProcessIdentity cmdlet to grant the default search account full permission towards the web application in question
  • Create a new content DB and move all sites (using move-spsite) to it
  • try to crawl only a single site collection (http://servername/sites/project)
  • create a new web application and root site collection (http://servername:81). Crawl it with same setting and return exactly same error.
  • Set "Ignore SSL warnings" to Yes
  • Enable anonymous access

Error always the same. No result can be crawled in main site. Always the Context: Application 'Search_Service_Application', Catalog 'Portal_Content' Access is denied. Verify that either the Default Content Access Account has access to this repository, or add a crawl rule to crawl this repository. If the repository being crawled is a SharePoint repository, verify that the account you are using has "Full Read" permissions on the SharePoint Web Application being crawled. (0x80041205) error. Anything I missed?

  • Do you see any login failed on search sql databases? Or on index server?
    – ova
    Commented Mar 26, 2018 at 10:36
  • Is your crawl account is added into Web Application Default Zone? Commented Mar 26, 2018 at 15:24
  • @ThinkB4Code what do you mean by add to default zone?
    – Mark L
    Commented Mar 27, 2018 at 2:02
  • In order to crawl your web application data, the crawl account need permission to read data. So when you associate Search Service Application to Web Application its default crawl account get access in default zone, but if the crawl account changed in SSA it doesn't added automatically. So you can check if your crawl account is added to default zone or not. Click on your web application, from the ribbon select User Policy and select add new user to add the crawl account, select All Zones while adding. Commented Mar 27, 2018 at 4:35
  • @ThinkB4Code I checked and added already. My web application only have single default zone.
    – Mark L
    Commented Mar 27, 2018 at 5:39

2 Answers 2


EDIT See this solutions

Access is denied. Verify that either the Default Content Access Account has access

'Retrieve People Data for Search Crawlers' rights

disable the LoopBackRequest

  • I setup search application using the wizard. Shouldn't the wizard grant the permission automatically? Could you please give me some reference?
    – Mark L
    Commented Mar 26, 2018 at 14:23
  • Thanks for your advice. The error is exactly same as the old thread. But the outcome still the same after follow all suggestions...
    – Mark L
    Commented Mar 27, 2018 at 2:33
  • The web application authentication method is "default" (Claims based Auth) and the server is Win2016. Not sure whether some auth related settings need to be configured?
    – Mark L
    Commented Mar 27, 2018 at 2:40

In short, the network connection is using proxy and authentication cannot pass through. Hence the crawling return 401 access denied.

Here is how I find the cause.

  1. I checked IIS raw log. The c-ip (client ip) is an unknown IP address for me. After checking it is our company's proxy server ip. Also cs-username is blank and sc-status is 401.

  2. Checked IE > Internet option, connection have not setup any proxy.

  3. Find this article on web. Run following command to clear the proxy settings and restart search service:

a. netsh winhttp show proxy
b. netsh winhttp reset proxy
c. Net stop Osearch16
d. Net start Osearch16

  1. Crawl again and this time is success. Checked the IIS log, no more 401 error and username is my crawling account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.