Overview

You are having a problem with the GFI LanGuard Attendant Service on the LanGuard server or an Agent on a client machine. The service does not start, and the error comes up:

"Windows could not start the GFI LanGuard 12 Attendant Service service on Local Computer.

Error 1067: The process terminated unexpectedly."

Solution

The common root causes for the error 1067 are the problems with the user account specified to run the service, corrupted installation, or some other processes, such as anti-virus, interfering with the Attendant service normal operations.

1. If you are not using the latest product version - Upgrade the GFI LanGuard.
2. Ensure Real-time Protection Engines Exclusions are correctly set up.
3. If the LanGuard dashboard also fails to load with an 'invalid license' error, follow the steps of the corresponding article.
4. Ensure that the user account specified to run the service has required administrator privileges. On the machine with failing Attendant service, explicitly add the user account that is running the service to the Log on as Services Local Security Policy:
   1. Navigate to Start > Run and type secpol.msc and press Enter.
   2. Expand Local Policies, and choose User Rights Assignment.
   3. Scroll down till you see Log on as a service.
   4. Right-click it and go to Properties.
   5. Click Add User or Group and add that account there.
   6. Click Apply and OK and close out of the Local Security Policy.
   7. Apply the changes.
   8. Run gupdate /force from the command prompt with administrator rights to update the policy.
   9. (Re)start the GFI LanGuard Attendant service.

If you are still getting an error after the above steps, this usually means a corrupted installation or environmental issues.

If the issue is on the Agent machine

1. Manually uninstall the Agent by copying the .msi file located at C:\Program Files (x86)\GFI\LanGuard 12\Agent from the server machine, running it on the Agent machine, and choosing to uninstall the agent.
2. Verify if the registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gfi_lanss12_attservice has been removed. If it still exists, delete it. You can back up the registry before this.
3. Reboot the machine.
4. Attempt to deploy the agent once again, at which stage the attendant service will be reinstalled.

If the issue is one the LanGuard server machine

Check the Windows Event Logs to understand what Windows process is preventing the service from starting. It would be showing as an audit failure under the Windows security event logs, and in the system event logs, the source would normally be the Service Control Manager.

Since this is a Windows issue and not a LanGuard one, we do not have specific resources to address the discovered causes.

If nothing helps, try repairing your LanGuard installation and see if it fixes this issue. If it doesn't, it is recommended to reinstall the LanGuard server:

1. If you need to keep the current configurations, export them.
2. Write down your license and database details.
3. Uninstall LanGuard via the Windows Control Panel and restart the server.
4. Check whether the GFI LanGuard XX Attendant service was removed successfully. If it is still there, remove LanGuard manually via the Registry and restart the server.
5. Disable antivirus and install LanGuard, strictly ensuring all the requirements and following the installation steps.
6. If you exported the configurations, import them.
7. Run a Manual Update.

Testing

Restart Attendant service. If the issue persists, contact GFI LanGuard Support.

Related Articles

• Why is GFI LanGuard Attendant Service Not Starting, Keeps Stopping or Crashing?