GFI LanGuard AI – Product Releases

What’s new in GFI LanGuard

Version 12.17

These notes describe the changes for customers upgrading from GFI LanGuard 12.16. Please read the notes for administrators before upgrading.

Highlights

• Windows Server 2025 is detected and patched. It was previously reported as Windows 11.
• Microsoft Edge and the Edge WebView2 Runtime are now detected as missing updates and can be deployed from the console.
• Upgrades keep your configuration. The setup no longer reports a successful upgrade as failed, resets settings, or removes an existing scan engine when it rolls back.
• WAN agent remediation completes on endpoints that were offline when the job started.
• Agent scans on Windows Server no longer end silently without a result.

New features and improvements

• Windows Server 2025 detection. Windows Server 2025 is identified correctly, shown with the right icon in the console and web console, and evaluated against the Windows Server 2025 patch catalog. Windows 11 is no longer misidentified on computers that were already classified as servers.
• Microsoft Edge and Edge WebView2 Runtime updates. Edge Stable, Edge Extended Stable and the WebView2 Runtime are evaluated on x86 and x64 Windows and reported as missing when the installed version is older than the catalog. Deployment runs the Edge installer silently, and the next scan shows the update as installed.
• Scheduled program updates continue when the GFI update server cannot be reached. A scheduled update used to stop with “Unable to contact the update server!” whenever the license check failed, while a manual Check for Updates on the same server worked. A scheduled update now continues as long as the license installed on the computer is valid, and the update history records why the server could not be reached. Updates still stop when the license itself is invalid or has been refused.
• WAN remediation is tracked per computer. The server keeps every WAN deployment request, re-sends it whenever the agent checks in, and accepts results that arrive after the job’s timeout. A computer that has not reported stays pending with a “Waiting for the WAN agent” message instead of being marked as timed out. Patches staged for a job that has already ended are discarded instead of installed silently.
• Clearer remediation status for WAN agents. A busy agent, a failed package download, or an error the agent will not retry is shown on the computer with its reason. Starting a remediation while WAN functionality is switched off on the server fails within seconds with a message that says so, and the Activity Monitor warns when WAN agents exist but WAN functionality is disabled.
• Missing-patches scan failures are visible. When the Windows Update search on a computer fails, the Missing Patches sensor and the vulnerability level no longer keep the values of the last successful scan. The sensor is cleared and a red hint is shown in the desktop and web consoles, so a computer whose patches are no longer being checked no longer appears compliant.
• Agent deployment stops retrying a failing install. After ten consecutive failed installs or upgrades on a computer, automatic deployment is suspended for that computer and shown as an error until the machine is repaired, its credentials are changed, or a deployment is requested. Previously the same failing installer was retried on every cycle.

Fixes

Installation and upgrade

• Fixed an upgrade that completed but required a restart being reported as failed and offered again. The setup now asks for the restart once, at the end.
• Fixed upgrades silently resetting the scan engine’s database setting, the console license key, scheduled scans and reports, scan profiles and other settings to their defaults. The upgrade now keeps a complete backup of your settings, and stops before changing anything if the backup cannot be made.
• Fixed a failed or cancelled upgrade uninstalling a scan engine that was installed before setup ran, which also removed its data, definitions and the console license. The rollback now removes only an engine that the same setup run installed.
• Fixed uninstalling the scan engine while the console remained installed deleting the console’s data files, definitions and license key along with the engine.
• Fixed configuration files that were in use during an upgrade being replaced with the package defaults at the next restart. They are now restored after the restart.
• Fixed the Central Management Server component being pre-selected when upgrading a console that never had it.
• Fixed the upgrade failing when a support library in System32 was locked by a running process. The installer now stops the service holding the file and retries, and any file still locked is replaced at the next restart.
• Fixed the agent installer stopping the Attendant service on the LanGuard server itself and then aborting, which left the service stopped until restarted by hand.
• Fixed silent agent upgrades asking Windows to shut down third-party services that share the Visual C++ runtime, which could stop or terminate those services. The agent installer no longer requests this, and no longer replaces a newer runtime installed by other software.
• Fixed the “Failed to upgrade the database” dialog opening a knowledge-base address that no longer exists.
• Fixed the Attendant service staying stopped after a console or scan engine upgrade was cancelled or failed, which left scheduled operations and remote device management switched off until the service was started by hand.
• Fixed the setup database page saving an entry that is not a SQL Server name when the search for SQL servers found none, which left the console with an empty computer tree and an empty Activity Monitor.

Scanning and patch detection

• Fixed some updates being reported as missing on computers that already run a newer version. This was seen with the Google Chrome 152 MSI update on computers running Chrome 154 or later.
• Fixed missing-patches scans of Red Hat Enterprise Linux 9 and other DNF-based distributions failing after a successful SSH connection, which left the host reported with no missing updates.
• Fixed agentless “Full Vulnerability” scans hanging in the offline Windows Update stage with the scan stuck at zero computers scanned.
• Fixed agent scans ending silently after the built-in scanning profiles had been re-imported.
• Fixed the scanner ending unexpectedly when writing patch records with very long reference lists, first seen with the September 2026 cumulative updates.
• Fixed the Windows Update offline catalog (wsusscn2.cab) failing to download on servers that download directly from the internet. Microsoft now redirects the catalog address to HTTPS, and the download follows that redirect.
• Fixed Windows 11 24H2 cumulative-update deployments being reported as failed although the update installed. The checkpoint update that ships alongside the cumulative update is no longer installed as a separate step.
• Fixed remediation attempting to install .NET servicing metadata files and failing. These files are now recognized and skipped.
• Fixed the Visual Studio Client Detector Utility being reported as missing an update on machines where a newer version was already installed, which deployed the older version and failed.
• Fixed a scheduled scan deleted through the web console reappearing after a service restart.

Console

• Fixed the computer tree losing its WAN agents (Remote Devices shown empty) and other computers after a console restart when the SQL Server login uses a day-month-year date language, such as German, French, Spanish, Italian, Dutch, Polish or British English. The same error affected the “List All Computers” API call and the “Last scan time” tree filter. If the computer list still cannot be loaded for another reason, the console now shows a warning instead of a silently incomplete tree.
• Fixed reports, Patch Auto-Download and advanced filters misreading dates when the SQL Server login uses a day-month-year date language. The Computer Security Overview, Scan History and Remediation History charts stayed empty, the Vulnerability Status and Patching Status reports placed items in the wrong age group, Patch Auto-Download with “Only needed patches” and a retain period failed, and date conditions in advanced filters were read incorrectly.
• Fixed more than half of the advanced filter conditions failing in the German, Italian, Japanese and Chinese consoles.
• Fixed the Agent Diagnostics run timing out behind routine scan imports, which the console reported as a firewall error. The diagnostics import is now handled first.

Agents and relays

• Fixed a Relay Agent failing to start its web server after the agent was reinstalled by hand. The relay configuration is now delivered again whenever it is missing.
• Fixed the server’s WAN agent settings being reset to defaults under concurrent access, which silently switched WAN agent functionality off.
• Fixed agents whose stored license key had expired no longer receiving updates (“You are no longer entitled to product updates”) even after the console license was renewed. The server now keeps every agent’s license key in step with its own, and a stalled agent resumes updating after the server’s next agent sweep.
• Fixed the WAN connection not recovering after a connection drop, after which stopping the Attendant service could hang.
• Fixed new or changed scanning profiles not reaching WAN agents, which kept using the previous profiles.
• Fixed scans of a WAN agent ignoring the chosen scanning profile when its name contains non-ASCII characters, such as the German default “Vollständiger Scan”.
• Fixed scans not reaching a WAN agent when the target was entered in a different letter case or by its DNS name. The computer was scanned over the network instead.
• Fixed a WAN agent skipping its daily scheduled scan when it started after the scheduled time or resumed from sleep.
• Fixed the patch verification scan after a deployment never running on WAN agents, which left their patch status unchanged until the next scan.
• Fixed agent settings saved on the Remote Devices node (scan schedule, scan profile, auto-remediation, credentials) never reaching the WAN agents under it.

Security and hardening

• The Apache HTTP Server that LanGuard bundles for the server, relay agents and agents is updated from 2.4.66 to 2.4.68.
• The bundled web server no longer includes OpenSSL libraries, which it did not use. Existing agents remove them when they upgrade.
• Setup, Central Management Server setup and the automatic license-key update no longer write the SQL Server password, the service account password or the license key to log files.
• Hardened how the scan engine connects to the scan-results database.
• Hardened the web console’s scheduled report pages.

Known issues

• Some WAN agent scans store only part of their results. A scan of a WAN agent started with Scan and refresh information now (from the computer tree or the dashboard), or through the API, finishes and is imported, but only ports, services, shares, users and processes are stored. Missing updates, vulnerabilities, installed applications and hardware are not stored. The computer can then show no missing updates and “No Security Audits performed”. This also affects earlier versions.
  Workaround: start the scan from the Scan tab with the WAN agent computer as the target. The agent’s own scheduled scans are not affected. Scanning the computer this way replaces the incomplete result with a complete one.

Notes for administrators

• The installer fixes apply to this upgrade. The upgrade to 12.17 runs the new setup, so the configuration backup, restart handling and rollback changes above protect the upgrade from 12.16 itself. Setup no longer restarts the computer or asks for a restart part-way through; if a restart is needed, one message is shown at the end. If setup stops with “Configuration backup failed”, nothing has been changed yet: close the program holding the listed file and run setup again.
• Reconnect to the Central Management Server after upgrading. The upgrade resets the console’s Central Management Server settings. If the console reports to a Central Management Server, open Configuration > Central Management Server, click Configure Server, select Enable central management, and enter the server address, port and site details again, and the credentials if you do not use the GFI LanGuard service credentials. The console reconnects as the same site.
• Edge updates appear after the upgrade. Computers with an older Microsoft Edge or Edge WebView2 Runtime show these updates as missing after their first scan on 12.17 and can be deployed like other updates. Keep the patch definitions current to be offered the latest Edge. Edge updates are not offered on ARM64 computers.
• Windows 11 x64 label. Windows 11 x64 hosts were previously reported as “Windows 11”. They are now reported as “Windows 11 x64”, matching every other Windows edition. Saved filters, reports or scripts that match on the exact string “Windows 11” should be updated.
• WAN remediation jobs stay pending after the timeout. A WAN computer that has not reported by the job’s timeout remains pending and completes whenever the agent reports, up to 7 days by default (RemediationExpiryDays in the WAN agent settings, 1 to 7). Cancel is not available on a job that has ended. WAN agents from 12.16 or earlier work normally against a 12.17 server.
• Agent deployment suspends after repeated failures. Computers whose agent install has failed ten times in a row show an error and are no longer retried automatically. Repair the machine, change its credentials, or request a deployment to resume. Set AGENT_MANAGER_MAX_CONSECUTIVE_DEPLOYMENT_FAILURES to 0 in the Agent Manager settings to restore the previous behavior.
• Agent web server version. Agents report Apache 2.4.68 once they have upgraded through the daily agent health check. Until then, vulnerability scanners continue to report 2.4.66 for that machine.
• Scanner diagnostics. A failure inside the scanner now writes a diagnostic file alongside the logs. Include it with the Troubleshooter bundle when reporting a scan that ended unexpectedly.
• Windows Update offline catalog address. The packaged WSUSSCN2FileUrl remains an HTTP address so that agents served by a relay keep working; the HTTPS redirect is followed automatically. A manual edit to HTTPS is no longer needed and is overwritten on repair or upgrade, as before.

Downloads and Upgrades:

For product downloads and information about upgrading GFI LanGuard, visit the GFI Upgrade Center.

If you have additional queries about these changes, please do not hesitate to contact us or an authorized GFI Partner directly.