Here's the answer I got from Laura Liu over on the Microsoft partner forums.
Regarding your issue, you could look in logs and find if there is a below error in ULS log (Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS):
w3wp.exe (0x1594) 0x1064 SharePoint Server Search Query Processor g2j3 High AuthzInitializeContextFromSid failed with ERROR_ACCESS_DENIED.
You could refer to the following article.
Why the tokenGroupsGlobalAndUniversal (TGGAU) attribute matters in SharePoint 2010
In order to call the AuthzInitializeContextFromSid, the caller “service account” needs to able to read the TGGAU attribute. In Windows 2000 and Windows 2003 domain, members of the Pre-Windows 2000 Compatibility Access group are able read the TGGAU attribute. At a minimum, certain service accounts like the search service account need to be a member of this group.
So please try to make sure the Content Access Account has read access to the user objects in AD (Add the Windows account to the Windows Authorization Access group by using the Active Directory Users and Computers snap-in).
Or you could try the following steps.
Load the SharePoint 2010 PowerShell environment
Run: new-spmanagedaccount -Credential USERACCOUNTDOMAIN\USERNAME
Load SharePoint Central Administrator
Go to: Security | Configure Service Accounts
Select: Service Application Pool – SharePoint Web Services Default
Set the account to the one you just created in Step #2
Please let me know if there is anything misunderstanding or you have any concern. Thanks!
Partner Online Technical Community