Overview

GFI LanGuard Attendant service (lnssatt.exe) is not starting, can not be restarted, randomly stops working, or crashing with the errors in Windows Event logs.  One of the following error messages is displayed in the LanGuard console:

Attendant Service stopped due to Attendant Service not running.

or

Scheduled operations disabled due to stopped attendant service. Click here to restart.

Solution

If you see this message for the first time, verify whether you can reproduce the issue by (re)starting the GFI LanGuard Attendant service:

1. Open the Services panel by going to Control Panel > System and Security > Administrative Tools > Services.  
2. Locate the GFI LanGuard 12 Attendant service, right-click on it and Start it (or Restart if the service is already running).

If the service is starting without problems, the error messages in the LanGuard console should disappear, and you can proceed with the usual LanGuard operations.

If the Attendant service keeps failing to start, stopping, or crashing, this may be caused by problems with the user account specified to run the service,  a corrupted LanGuard installation or the host operating system, SQL database issues, or some other processes, such as anti-virus, interfering with the Attendant service normal operations.

1. Confirm that the required Anti-Virus and Firewall exceptions are in place.

Please review and correct your Real-time Protection Engines and Firewalls Exclusions as their absence can lead to unexpected errors. For example, a firewall might block some packets during scanning and remediation operations, the target machine will detect numerous failed connection attempts and lock the domain service credentials, and the Attendant service would stop or crash.

2. Verify that you are running the latest LanGuard version.

It is recommended to always run the most recent LanGuard versions to receive all the latest program updates and vulnerability definitions. Since the error above is frequently caused by the corrupted installation, Upgrading LanGuard may remedy this by refreshing all the .dll files.

3. Check the user account specified to run the Attendant service.

One of the common root causes is that there are problems with the user account specified to run the service:

• Password expired or locked up due to domain policy settings.
• User account removed from the local administrator's group due to GPO policy.
• Manual changes to the Domain administrators group members.
• Incorrect settings were applied during the LanGuard fresh installation, upgrade, or migration.

Follow these steps to check the user account credentials and permissions:

1. In the Services panel, double click the GFI LanGuard 12 Attendant service and select the Log on tab. Notice the account specified to start the service; all the later checks will be performed for this account.
2. Right-click on Start > Computer Management, in the opened window, go to Local Users and Groups  > Groups, and double click on the Administrators group. Verify that the user above belongs to this group. If it isn't, add it to the group.
   
3. For a local user account, go to Local Users and Groups  > Groups and double click on the user:
    
4. If the account is disabled or locked out, enable/unlock it.
5. For domain user account, ask the administrator to check user account properties in Active Directory.
6. Try to run any program as the user above and check whether the password is correct. If the check fails, enter the correct credentials in the Log On tab for the GFI LanGuard 12 Attendant service.

   

7. If all checks above passed but the problem persists, try to change the credentials to another account with local administrative rights - specify an account having Local administrative rights in the format <Domain>\<User> or browse to the admin user. Check the Best Practices for Setting up Account Permissions with Alternative Credentials in LanGuard.

Start the Attendant service to verify if the issue is gone. If the problem persists, proceed with the less common root causes.

4. Check for potential database authentication issues.

If there are SQL database backend authentication problems, the debug log lanss_vXXX_attendantservice.csv located in the %Data%\GFI\LanGuard 12\DebugLogs\ would have the relevant errors:

• "Login failed. The login is from an untrusted domain and cannot be used with Windows authentication."

This indicates the issues with Windows Authentication. The best course of action is to configure SQL Mixed Authentication mode instead and sa user to connect to the database.

5. Fixing incorrect installation or upgrade.

If you started to experience problems after the LanGuard fresh installation, upgrade, or migration, the Attendant service issue might be caused by installation problems, for example, due to antivirus not being disabled during the install process or one of the other requirements not being met.

In such a case, uninstall LanGuard from the control panel, reboot the server, disable antivirus, unblock the installer and Install LanGuard.

6. Removing stuck patches in the download queue.

There were cases when the Attendant service crashed randomly when trying to download patches stuck in the queue. Launch the LanGuard console and check the download queue in the Activity Monitor tab. If there are patches stuck there, Purge Patch Download History.

Testing

Start the Attendant service, launch the LanGuard console, and verify that the error message is gone. If the service still fails to start, it is most likely a local environment settings problem and should be troubleshooted, starting with examining corresponding service start errors in the Windows Events logs.

If you cannot identify the problem there, Export the Windows event viewer application and system logs and contact GFI LanGuard Support. If the service is actually crashing, collect all the trouble_lanss.exe.dmp file(s) located in the temp directory of the LanGuard service accounts and the server's local admin account C:\Users\AppData\Local\Temp, and add these to the ticket.

Related Articles

• Best Practices for Setting up Account Permissions with Alternative Credentials