Event details
Hi there! We're seeing continuous error popups on multiple Windows 11 23H2 systems in our organization. We have an on-prem 2019 AD and have been using the CIS Win11 v2.0 GPO without any issues until recently. We'd really appreciate any insights you can provide to help us resolve this. Thanks a lot!
Errors Encountered:
"The SearchProtocolHost.exe error "The instruction at 0x00007FF75424610B referenced memory at 0x0000000000000000. The memory could not be read,""
Outlook Notification: "Windows search exited without properly closing Outlook data file" appears for some users.
Event Viewer Access: When the error popup appears, attempting to open eventvwr.msc from Run shows "not enough memory," but it can be opened from the Start menu.
Observations:
Temporary Workaround: Unlinking the CIS GPO resolves the issue. We are using CIS Win11 v2.0 GPO for a long time without issues. This GPO has all the CIS guidelines except BitLocker, LAPS, and Windows Update policies.
Timeline: Issues reported by some users in early January, with more reports in early February.
Search Index: The search index shows as paused, and the Search Index Troubleshooter reports recent crashes of SearchProtocolHost.
Troubleshooting Steps Taken:
Group Policy Settings:
Disabled Policies: Windows Defender, Memory-related, Search-related, Device Guard
Despite disabling these policies separately, the issue could not be isolated.
Reset Windows Search:
Stopped the Windows Search service, deleted the search index database (Windows.db), and restarted the service.
Rebuild Search Index:
Attempted to rebuild the search index through Settings.
Windows Updates:
Ensured the system is up to date with the latest patches and updates.
System File Checker (SFC) and DISM:
Ran sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to repair corrupted system files.
Hi Satish,
Thank you for sharing. We've gone through each of your errors, and would have recommended the system file checker and DISM for the first one. Your Outlook notification suggests you might have a third-party add-in that may be provoking that problem, so I'd suggest disabling any unnecessary add-ins to see if that helps. The third one, yeah, we'd have recommended rebuilding the index as well. That said, however, we'd recommend pulling a memory dump file and sharing it with your customer success account manager and/or our support team, as these errors in combination you're seeing will require some digging to find the culprit.
Thank you for the response. After upgrading to 24H2, there are no error popups. However, we are seeing this issue in most of our systems, and the feature upgrade will take a considerable amount of time