Problem changing search topology

Question

I'm setting up a 3 tier architecture in SharePoitn 2010 for a client and am getting an error trying to mirror the Search Query Component to the WFE server from the APP server it is currently running on. It attempts it for a couple of minutes and then dies
with the error
Topology activation was aborted because of Microsoft.Office.Server.Search.Administration.QueryComponentTransitionException: System.IO.IOException: Logon Failure: The target account name is incorrect.
The search service itself is running under its own search account and I'm carrying out this operation whilst logged in as a farm administrator account.
I'm not clear what login it is trying to use, and where it is trying to login to! I checked he index location on the D drive of the WFE and the admin and search accounts have write permission to it (they have been added to the WSS_Admin_WPG group.
Has anybody seen this before? Googling for it doesn't seem to turn up anything much. I've tried recreating the Search SA multiple times already, and no joy. I'm currently stuck with two additional scheduled jobs called
Database repartitioning timer job for search application Search Service Application on
xxxxWFE and
Database repartitioning timer job for search application Search Service Application on
xxxxAPP which seemingly won't complete ever, nor can they be deleted.
Thanks,
Rob

Answer 1

I also note that in the system logs I'm getting an error relating to Kerberos,despite the fact that this server farm is using NTLM on Central admin and Claims/NTLM on the other Web Applications. This looks like it might be related:
Log Name:      System
Source:        Microsoft-Windows-Security-Kerberos
Date:          15/05/2014 09:33:16
Event ID:      4
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      xxx
Description:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server xxx$. The target name used was cifs/xxx. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name
(SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a
different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server
name is not fully qualified, and the target domain (xxx) is different from the client domain (xxx), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Kerberos" Guid="{98E6CFCB-EE0A-41E0-A57B-622D4E1B30B1}" EventSourceName="Kerberos" />
    <EventID Qualifiers="16384">4</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-05-15T08:33:16.000000000Z" />
    <EventRecordID>12846</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>xxx</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="Server">xxx$</Data>
    <Data Name="TargetRealm">xxx</Data>
    <Data Name="Targetname">cifs/xxx</Data>
    <Data Name="ClientRealm">xxx</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>