Fix Incorrect Permissions on Windows Search Directories

If Windows Search is failing to find files, showing errors, or crashing, incorrect permissions on its search directories are often the culprit. This guide explains how to identify and fix these permission issues using built-in Windows tools, restoring proper search functionality without third-party software.

Background: Why Windows Search Directories Get Corrupted

Windows Search relies on a set of directories and files that store the search index, which is a database of file locations and metadata. These directories are typically located under C:\ProgramData\Microsoft\Search and C:\Windows\System32\config\TxR. The index is built and maintained by the Windows Search service (WSearch), which runs under the LocalSystem account but also uses a special security principal called ALL APPLICATION PACKAGES to allow UWP apps to access search data.

Permission problems can arise from several sources:

Third-party security software that locks down or modifies default ACLs (access control lists).
Manual changes by users or administrators trying to “optimize” the system.
Corrupted system updates that fail to apply correct permissions.
Malware that alters permissions to hide its presence.
Disk errors that damage the NTFS security descriptors.

When permissions are wrong, the WSearch service may fail to start, return error 0x80070005 (Access Denied), or simply not index new files. The fix involves resetting the ACLs to known-good defaults.

How Windows Search Permissions Work

The search index directories are protected by NTFS permissions. The key principals and their typical rights are:

SYSTEM: Full control
Administrators: Full control
Users: Read and execute, list folder contents
ALL APPLICATION PACKAGES: Read and execute (for UWP apps)
RESTRICTED: Read and execute (for sandboxed processes)

These are inherited from the parent ProgramData folder. The WSearch service also creates a subfolder named Data with additional ACLs. If any of these are missing or modified, the service may fail to read or write its index files.

Windows does not provide a one-click “reset permissions” button for these folders, but you can use command-line tools to restore the correct ACLs. The two primary methods are icacls and takeown, which are built into Windows.

Step-by-Step Fix: Reset Permissions Using icacls and takeown

Before starting, close any applications that might be using the search index (like Outlook). You will need administrative privileges.

Open Command Prompt as administrator: press Win, type cmd, right-click Command Prompt, and select Run as administrator.
Stop the Windows Search service by running: net stop wsearch. If it fails, note the error message—it may indicate a deeper issue.
Take ownership of the Search folder. Run: takeown /f "C:\ProgramData\Microsoft\Search" /r /d y. This gives the Administrators group ownership of all files and subfolders.
Reset the ACLs to inherit from the parent. Run: icacls "C:\ProgramData\Microsoft\Search" /reset /t /c /q. The /t applies to all subfolders, /c continues on errors, and /q suppresses success messages.
Reapply the required explicit permissions. Run the following commands one by one:

icacls "C:\ProgramData\Microsoft\Search" /grant SYSTEM:(OI)(CI)F /T
icacls "C:\ProgramData\Microsoft\Search" /grant Administrators:(OI)(CI)F /T
icacls "C:\ProgramData\Microsoft\Search" /grant *S-1-5-32-545:(OI)(CI)RX /T
icacls "C:\ProgramData\Microsoft\Search" /grant *S-1-15-2-1:(OI)(CI)RX /T
icacls "C:\ProgramData\Microsoft\Search" /grant *S-1-5-32-546:(OI)(CI)RX /T

Here, *S-1-5-32-545 is the SID for Users, *S-1-15-2-1 is ALL APPLICATION PACKAGES, and *S-1-5-32-546 is Guests (usually not needed but harmless). The (OI)(CI) flags mean object inherit and container inherit, so these permissions propagate to all children.

Restart the service: net start wsearch. If it starts without error, try a search. If it fails, reboot and test again.

Alternative Fix: Rebuild the Search Index

If resetting permissions does not resolve the issue, the index itself may be corrupt. Rebuilding it is a safe next step. Go to Settings > Privacy & security > Searching Windows > Advanced indexing options. Click Advanced, then under Index Settings, click Rebuild. This will delete and recreate the index, which can take several hours for large drives. During this time, search results may be incomplete.

If the rebuild fails due to permission errors, you may need to delete the entire Search folder after stopping the service, then restart the service. Windows will recreate the folder with default permissions. To do this:

Stop the service: net stop wsearch.
Rename the folder: ren "C:\ProgramData\Microsoft\Search" Search.old (do not delete immediately).
Start the service: net start wsearch. It will create a fresh Search folder.
If everything works, you can delete the old folder later.

Common Problems and Misconceptions

One frequent misconception is that you need to change permissions on the C:\Windows\System32\config\TxR folder. This folder is used by the registry and should not be modified unless you are an expert. The search index is not stored there in modern Windows 11; it is only in ProgramData\Microsoft\Search.

Another issue is that users sometimes run icacls with the wrong paths or forget the /T flag, resulting in partial fixes. Also, if you have a non-English Windows, the ProgramData path might be localized (e.g., Dati programma in Italian), but the actual folder name remains ProgramData in the file system, so the path is still correct.

If the WSearch service fails to start even after resetting permissions, check the Event Viewer for error logs. Common errors include 0x80070005 (access denied) and 0x80070422 (service cannot be started). The latter may indicate that the service is disabled; ensure its startup type is Automatic in services.msc.

When to Use the Built-in Troubleshooter

Windows 11 includes a dedicated Search troubleshooter. Go to Settings > System > Troubleshoot > Other troubleshooters > Search and Indexing. Run it; it will automatically detect and fix common permission issues. This is a good first step before manual methods, as it is non-invasive. However, it may not fix deeply corrupted ACLs, in which case the manual icacls approach is more thorough.

Safety and Precautions

Always create a system restore point before making significant changes to system folders. To do this, search for “Create a restore point” in the Start menu, select your system drive, and click Create. If something goes wrong, you can roll back.

Do not run icacls on the entire ProgramData folder, as that could break other applications. Stick to the Search subfolder. Also, avoid using takeown on the entire drive; it is only safe on the specific folder you are fixing.

If you are not comfortable with command-line tools, you can use the GUI: right-click the Search folder, go to Properties > Security > Advanced, and click Restore defaults. This works in many cases, but it only resets to inherited permissions, not explicit ones, so it may be insufficient.

Frequently Asked Questions

Why does Windows Search stop working after a Windows update?

Windows updates can sometimes reset or alter security descriptors on system folders. If the update fails to apply correct ACLs, the search service may lose access. Running the icacls reset as described above usually fixes it.

Can I just delete the Search folder to fix it?

Yes, but only after stopping the service. Deleting it while the service is running can cause crashes or data corruption. After deletion, restart the service; Windows will recreate the folder with default permissions.

Will resetting permissions delete my indexed files?

No, it only changes access control lists. Your files remain intact. However, if you rebuild the index, the index database is recreated, but your actual files are untouched.

How long does it take to rebuild the search index?

It depends on the number of files and your drive speed. For a typical system with 100,000 files, it can take 30 minutes to several hours. You can continue using your PC, but search results will be incomplete until the rebuild finishes.

Is it safe to use third-party permission reset tools?

Most reputable tools are safe, but they often apply broad changes that may affect other parts of the system. Using built-in icacls is more precise and avoids unintended side effects.

What if the problem persists after all these steps?

If search still fails, consider running sfc /scannow to repair system files, or DISM /Online /Cleanup-Image /RestoreHealth to fix the system image. In rare cases, a Windows in-place upgrade may be needed to repair the OS.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →