Hosts file getting deleted

Today, I modified the search indexer to point to a seperate wfe server instead of crawling all the wfe's. Once I modifed the setting, the following error started throwing up in the eventviewer:

Reason: Could not find file 'C:\WINDOWS\system32\drivers\etc\HOSTS'.

Event Type: Error
Event Source: Office SharePoint Server
Event Category: Office Server Shared Services Event ID: 6482
Date: 1/19/2008
Time: 6:12:03 AM
User: N/A
Computer: ******************
Description:Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance Reason: Access to the path 'C:\WINDOWS\system32\drivers\etc\HOSTS' is denied.
Techinal Support Details:
System.UnauthorizedAccessException: Access to the path 'C:\WINDOWS\system32\drivers\etc\HOSTS' is denied. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at System.IO.StreamWriter.CreateFile(String path, Boolean append) at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize) at System.IO.StreamWriter..ctor(String path, Boolean append) at System.IO.FileInfo.CreateText() at Microsoft.Search.Administration.Security.HOSTSFile.CleanupDedicatedGathering(Hashtable HOSTSFileMappings, StringBuilder HOSTSComments, IEnumerable obsoleteHosts, String dedicatedName, Boolean isDirty) at Microsoft.Search.Administration.Security.HOSTSFile.ConfigureDedicatedGathering(SearchServiceInstance searchServiceInstance, SPServer dedicatedWebFrontEndServer, IList`1 previousWebApplicationHostNames) at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.SynchronizeDefaultContentSource(IDictionary applications) at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize() at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)

The above error shows up because the Sharepoint Timer job actually deletes the hosts file after you modify the wfe the crawler has to point to. I had taken a backup of file and I went ahead and restored it. But after restoring it back, the following error throws up in the eventviewer:

Reason: Access to the path 'C:\WINDOWS\system32\drivers\etc\HOSTS' is denied.

Event Type: Error
Event Source: Office SharePoint Server
Event Category: Office Server Shared Services
Event ID: 6482
Date: 1/19/2008
Time: 6:22:50 AM
User: N/A
Computer: ******************
Description:Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance
Reason: Access to the path 'C:\WINDOWS\system32\drivers\etc\HOSTS' is denied.
Techinal Support Details:System.UnauthorizedAccessException: Access to the path 'C:\WINDOWS\system32\drivers\etc\HOSTS' is denied. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileInfo.Delete() at Microsoft.Search.Administration.Security.HOSTSFile.CleanupDedicatedGathering(Hashtable HOSTSFileMappings, StringBuilder HOSTSComments, IEnumerable obsoleteHosts, String dedicatedName, Boolean isDirty) at Microsoft.Search.Administration.Security.HOSTSFile.ConfigureDedicatedGathering(SearchServiceInstance searchServiceInstance, SPServer dedicatedWebFrontEndServer, IList`1 previousWebApplicationHostNames) at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.SynchronizeDefaultContentSource(IDictionary applications) at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize() at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)

The following permissions need to be given to c:\Windows\System32\Drivers\etc folder for the wss_admin_wpg account :

• Traverse Folder / Execute File
• List Folder / Read Data
• Read Attributes
• Read Extended Attributes
• Create Files / Write Data
• Read Permissions
• Delete Permissions ( I will explain this .....)

The delete permission also needs to be given because the timer job actually deletes and recreates the hosts file. I was a bit hesitant to give this but had to do so to get it to work. After the permissions are given, I did not see any other errors in the eventlog

Later..