If you want to add  an Index server  to the farm, you need to install the
SharePoint Server 2007 bits on the server, not the search  Server bits.
Use the Advanced -> Complete installation method and join an existing
farm. SharePoint Server 2007 bits include the search server bits.

but thi smakes me confused. I asked Microsoft and
someone in the local user group, both of them said I can use
SharePoint for Search.

I know I can install another MOSS and ask this one as th eonly one to
do crawling, SharePoint for Search can not perform this task?

SharePoint for search  is much more limited than SharePoint Server 2007.
SharePoint Server 2007 does everything SharePoint for Search does. If
you were to get SharePoint for Search working in your SharePoint Server
2007 farm, you would lose a ton of search integration.

Please allow me to grab the idea: for those who has WFE and index
server running, the index  server is using MOSS 2007, not SharePoint
for Search?

If I am using MOSS 2007 Ent CAL for WFE, do I have to use the same
CAL for the index server?

Also, would you explain a little bit more regarding the lose of
integration?

You will lose integrated search  scopes, native integration of site
seach, and more. I would have to think about it and it's Friday ;-)

I do not know how the licensing works, but I suspect you must. Are you
using the enterprise feature set? ECS, BDC, and Forms?

See the following for details:
technet.microsoft.com/.../cc262901.aspx#section4

One more question:

If I use MOSS 2007 instead, I wil lnot have this error  or this has
nothing to do with what I am trying to use?

I highly suspect this error  goes away.

When I received  the error, there was a new entry in the event log:

Event code: 4007
Event message: URL authorization failed for the request.
Event time: 5/2/2008 2:43:50 PM
Event time (UTC): 5/2/2008 6:43:50 PM
Event ID: 4bc1ef0dc1bd4bedaXXXXXXXXXXXXX
Event sequence: 7
Event occurrence: 6
Event detail code: 0

Application information:
Application domain: /LM/W3SVC/1720207907/root-1-
128542272122991862
Trust level: Full
Application Virtual Path: /
Application Path: C:\Program Files\Microsoft Office Servers\12.0
\WebServices\Root\
Machine name: (Index server  Name)

Process information:
Process ID: 1540
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE

Request information:
Request URL: http://Index server:56737/SearchAdmin.asmx
Request path: /SearchAdmin.asmx
User host address: (Index Server IP)
User:(Domain user account as MOSS system account)
Is authenticated: True
Authentication Type: NTLM
Thread account name: NT AUTHORITY\NETWORK SERVICE



Trying to identify why this is still using NTLM and the rest of the
farm is using Kerberos.

I also tried to change the identity of OfficeServiceApplicationPool.
However, once I reset IIS, the changs went away.

Try running this command:

Psconfig.exe -cmd secureresources

The error  below looks like the Index server  has the incorrect
permissions for Office Server Web...and/or registry problems. I had this
exact error when fine tuning a scripted farm  installation. )(see
mindsharpblogs.com/.../4411.aspx for command
line setup)

And, you cannot change this to Kerberos from my testing. This
account/web will always reset automatically, including TCP port, IP,
etc. To be sure, SharePoint Server 2007 self-configures that IIS site.

On index? WFE or both?????????????????

On WFE. It wouldn't hurt to do it on the Index, however.

I ran both on WFE and Index server  with IIS reset. When I tried to
configure Office SharePoint Server Search from Central Admin, the same
error and event log shown.

Where did I missed so the authentication either using the wrong network
systen name or NTLM?

I only add  the index  server name to create SPN, do I need to add this
servr also in setSPN -A Http/Index server  Domain/Admin and SetSPN -A
Http/Index server.FQDN domain/admin ?

Perhaps I missed this one.

I added the WFE with all these settings and set as trusted.

Have you seen this blog?

www.sharepointjoel.com/.../kerberos-authentication
-and-sharepoint-key-resources.aspx

I don't think you can set the Search Web for Kerberos, but I could be
wrong. Just because I couldn't make it work doesn't mean it can't be
done.

When I first read this message I thought you were trying to implement
SharePoint Search server  2008 in a MOSS environment. That will work.
But if your farm  is using the MOSS 2007 Enterprise license you won't be
able to add  a SharePoint Server for Search Standard 2007 license to the
farm. SharePoint Server for Search Standard is used in a WSS only
installation to provide additional Search capabilities without buying a
full MOSS license. Since your farm is already running a full MOSS
enterprise license you won't be able to add an additional server to the
farm unless its also running SharePoint MOSS Enterprise 2007.

OK, today is Friday and absolute a shocking day to me since I started
working on this task.

Let me get it straight: when you guys have an index  server with MOSS
2007 ENT CAL farm, you are using one machine installed with MOSS 2007
ENT CAL, but not accepting connection at all. This machine only
crawls and index contents?

If this is correct, is there any documents I can read?

Please allow me to change the way I ask this question:

When you created MOSS WFE, you choose only the web fron-end
installation.

Whn you needed an application server, you install the whole 9 yard.

So, as long as I have one server  installed all components, any
additional WFE I add  to the farm  can have only Web Front-End installed,
correct?

On the other hand, I can not have web-front end installed only to have
crawling and indexing capabilities, correct?

I think I missed some reading some where.

I normally recommend that you do the full install on all servers in the
Farm. That just installs the binaries. They only run the services that
you turn on. The WFE only install is really for WFE servers that you
would put into a DMZ. Since they only have the WFE binaries, they can
only act as WFE servers even if a hacker takes them over. The full
install includes the binaries to run as a WFE also. So the only thing
you save in a normal Intranet environment  by doing the WFE only install
is a little bit of disk space. Servers installed using the full install
can be WFE only servers, WFE + other services like Indexing, or Indexing
only servers depending on how you configure services. WFE only install
servers can only be WFE servers and can't run any additional services
without re-installation.

Depending on the amount of content that's needs indexing the Index
server may be a dedicated server  with an Enterprise license that is not
acting as a WFE. Or it may be a server with an Enterprise License
acting as the index  server and a WFE. It all depends on which services
you start on the server after it joins the farm. But in either case, if
you are going to use it in a server farm  running MOSS Enterprise then it
needs to have an Enterprise license to join the farm. You can't use a
less expensive license just because its only doing Indexing.

If I install another MOSS 2007 ENT CAL and join the server  farm, this
error message will go away? Or I may still have this error?

BTW, if I choose to install Web-Front End (I only did once for very
brieft testing a year ago), I can have the requests come to this one
instead of the current  server with full components installed? right?

Yes, if you install a server  with the Moss 2007 Enterprise license it
should be able to join the farm  and become the index  server without
seeing the error  you reported.

You can have requests coming to any server running the Windows
SharePoint Services Web Application service. If you install the WFE
only install that's about the only service that server can run. With
the full install it can run just that service or almost any combination
you would like. Of course there are certain combinations that make
sense and certain combinations that don't.

Thank you very much for these great info. Did not really understand
the purpose of web front-end installation and with wrong info of
index server.

Where I could find info regarding these in clear concpets? have been
reading blogs, msdn, technet and books and hard to find something
like this.

I removed sharepoint  for Search and installed MOSS 2007. Unfortunately,
I received  the same error  when I tried to start Office SharePoint
Search service from CA. I also tried to start Excel Services on the new
server and not really started it.

So, I started both services with STSADM and it was successed. Then when
I tried to assign the index  file path to the new server, same error
message. I tried to do it with comman line, the path did not created.

Looks like the server  hosting CA is trying to call Index server with NT
Authority\Network Service account with NTLM. Trying to identify which
service did this on CA server and how to change or make it recognizable
by index server.

It appears the search  service account doesn't have sufficient
permissions on the index  directory.

Other than that, I am out of ideas.