Enterprise Vault Collections fail with a -1,073,741,502 Searcher shortly after the job begins

  • Modified Date:
  • Article ID:000086713


V7.1.2 and V7.1.5
Enterprise Vault (EV) Collection Task fails immediately after 'Wrote collection job XML' in the Job Status log.

V7.1.4, V7.1.5 and V8.0
EV Collection Task fails after release of the Index Server lease.


Error Message

V7.1.2 and V7.1.3
[#422298] EV searcher error - -1,073,741,502 Searcher exited with non-zero error code - {1.EN_US}.
Message: Failed: [#422280] The collection agent reported a failure.

V7.1.4, V7.1.5, and V8.0
{ Job Status Log }
- Wrote collection job XML \\testserver\ediscovery\Collections\\\ClearwellCollectionJob-134683169.xml for index server 1234EDFBE6501F64AAA1CEDF177B0FE931710000CWLAB
- Releasing lease on Index Server=1234EDFBE6501F64AAA1CEDF177B0FE931710000CWLAB, leaseId=
- Search failed for index sever 1234EDFBE6501F64AAA1CEDF177B0FE931710000CWLAB, ignoring for this run and moving ahead with rest of the index server results if any
- Task probably doesn't have any archives selected, the task might result in failure

{Icp RemoteJob Log }
[#422302] EV searcher error - -1,073,741,502 Searcher exited abruptly, check if the source account configured with the associated source is part of Local Administrators group



A. The User Access Control is enabled on the eDiscovery Platform (Clearwell) appliance.

B. The EV Service Account (VSA) does not have local administrator rights on the Clearwell Appliance.

The initial writing of the collection job XML in the local D drive scratch area, is performed by the service starting the EsaApplicationService.  This written action is followed by an update in the scratch folder, from the account that starts the EsaEvCrawlerservice (typically the VSA).

 C. A Group Policy Object is preventing the execution of a batch job for the EV Source Account.



A.  Disable User Access Control (UAC)
Note: UAC must be disabled for multiple eDP processes to function properly.  
Extracted from the Symantec Installation Guide | Install Prerequisite Checklist | Step 4 :
Verify that User Account Control (UAC) is set to “Never Notify”.

    1. Start | Run: msconfig

    2. Select Tools tab from the System Configuration popup

    3. Select 'Change UAC Settings' then 'Launch'

    4. From the User Account Control Settings window, lower the slide bar down to 'Never notify'

B. The EV Service Account (VSA) does not have local administrator rights on the Clearwell Appliance.

    1. Open The Administrators Group
Server Manager | Configuration | Local Users and Groups | Groups | Administrators

    2. Select Add...

    3. Enter the name of the account that starts the EsaEvCrawlerService in the 'Enter the object names to select' text box

    4. Select Check Names

    5. Once the account is verified, select OK

    6. Run the Clearwell Collection Task and verify the process continues with 'Search progress update' after the 'Wrote collection job XML' step within the Job Status Log.

C. A Group Policy Object is preventing the execution of a batch job for the EV Source Account.
- Contact your internal security team to discuss adding allow 'log on as a batch job' permissions for the EV Source Account.


Terms of use for this information are found in Legal Notices.



Did this article answer your question or resolve your issue?


Did this article save you the trouble of contacting technical support?


How can we make this article more helpful?

Email Address (Optional)