On Windows Server 2003 Indexing Service randomly changes from automatic to disabled and stops. Looking at the Event Log this is not preceded by any other related action...

As far as I know there is no Windows mechanism that disables the indexing service in this way. However, the indexing service is considered to be resource hungry. Therefore some admins and even developers decide the indexing service is not needed and disable it. That's why I suspect this is related to other software installed on the machine. Using auditing on the service registry key (HKLM\sustem\CurrentControlSet\CiSvc\Start, you should be able to define what user account is used to change the service properties. using a tool like sysinternals Process explorer or process monitor, you should be able to define which process is changing the key. Both might be interesting in trying to define who or what is changing the service. If you are really(!) certain the behaviour is unwanted, you might wor around it by changing the permissions on this registry key so that no-one can cchange the values. MCP/MCSA/MCTS/MCITP

Thanks for that SenneVL, I've turned on auditing for the key so we'll see what happens. As far as i can see only System, Creator Owner and Admins have the permissions required, and i know it's not me! Will let you know the outcome... Thanks.,

Hi, In addition to the suggestions “SenneVL” provided, you may also test the issue in Clean Boot to check if there is any third party software conflicts. For the detailed steps of how to boot into Clean Boot, please refer to the following Microsoft KB article: How to configure Windows XP to start in a "clean boot" state http://support.microsoft.com/kb/310353 Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks Arthur but it's a production server so no chance to run it on clean boot. Senne, left Process explorer and audting running overnight, service shut down/disabled again but no usable info returned. The shutdown happens at different, random times, usually overnight but not always. Still at a loss as to why... Thanks,