McAfee real-time scanning will not turn on: service errors 1068 and 1069

Fix it now

The switch in the interface does nothing because a Windows service underneath refused to start, and Windows publishes exactly why. 1068 is a dependency that failed. 1069 is a logon failure. 1064 is the service crashing on a control request. 1073 is a duplicate registration.

services.msc

1. Restart the machine and try the toggle once more before doing anything else.
2. Check the subscription. McAfee lists an expired subscription among the critical protection problems on its home page, in the same list as real-time scanning being off, and no service work re-enables a feature the entitlement has switched off.
3. In services.msc, find the services whose display names begin with McAfee and try to start any that are stopped. Note the number in any failure dialog – that number is the diagnosis.
4. For 1068, open the service’s Properties and read the Dependencies tab, then start what it relies on first. For 1069, open the Log On tab and set it back to Local System account.
5. Open Windows Security and confirm under Virus & threat protection that no second third-party antivirus is registered.
6. If services crash on start or Windows reports one already exists, remove McAfee with MCPR, restart, and install a fresh package.

To reach the setting itself, McAfee’s own help gives the route as: on the Home Page click Real-Time Scanning, then Real-Time Scanning settings, then Turn on.

If scanning reports as on and survives a restart, you are done. If the toggle refuses without any service error, the next section covers the two conditions that produce that.

Why it happens

Real-time protection is not a setting, it is a driver. McAfee registers a file system filter that sits in the path of every file operation, and a set of user-mode services that configure it, feed it definitions and report to the interface. If those services are not running, the driver is either not loaded or not being managed, and the interface has nothing to switch on.

That is why the service number matters more than the message in the McAfee window. Windows tells you precisely why a service refused to start, and Microsoft publishes each of these: the dependency service or group failed to start; the service did not start due to a logon failure; an exception occurred in the service when handling the control request; the specified service already exists. Four different sentences, four different repairs.

Two other conditions produce the same visible symptom with no service broken at all. A second real-time scanner competing for the same file system callbacks can leave both products half-functional. And an expired subscription takes the feature away by design – McAfee’s own help puts an expired subscription and real-time scanning being off in the same list of critical protection problems, and Microsoft describes a non-Microsoft product that expires as one that stops providing real-time protection. People spend hours on that one because the interface presents it as a switch that will not stay on.

Full reference

Microsoft’s published text for each number

Reading the symptom when there is no number

Are you actually protected?

Check rather than hope, because this is the failure mode where the answer is most often no. Microsoft documents that on a Windows client with a non-Microsoft antivirus registered, Microsoft Defender goes into disabled mode automatically. If McAfee holds that registration while its services are dead, Defender has stood aside for a product that is not scanning – the worst of both worlds, and nothing on screen tells you so.

Microsoft also documents the escape: Defender re-enables itself if the non-Microsoft product expires, is uninstalled, or otherwise stops providing real-time protection. That is designed for exactly this situation, but it depends on McAfee actually reporting that it has stopped. A service that fails to start may not report anything at all. So open Windows Security, read what Virus & threat protection says, and if nothing is genuinely protecting the machine, treat it as urgent rather than as a switch to fiddle with later.

Turning it back on once the services are healthy

1. Confirm every McAfee service in services.msc shows Running with its intended startup type.
2. On the McAfee Home Page, click Real-Time Scanning, then Real-Time Scanning settings, then Turn on.
3. Alternatively use the notification McAfee shows in the protection status area on the Home Page, which carries a Turn on action for exactly this problem.
4. Restart and confirm the setting holds. A toggle that reverts after a reboot is a service or entitlement problem, not a setting problem.

After a Windows feature update

Feature updates occasionally reset service configurations or leave a driver mismatched with a newer build, and a service that started for years can begin failing on the first boot after one. Check for a newer McAfee build before reinstalling: a product that has not been updated in a while is the likeliest thing to be out of step with a new Windows build, and installing the current package is less disruptive than a full removal.

What not to do

• Do not delete or recreate McAfee service entries by hand. That is what turns a recoverable duplicate into an unrecoverable one.
• Do not install a second antivirus as a workaround. It produces the exact class of fault described here.
• Do not leave real-time scanning off and rely on periodic scans. Periodic scanning is not equivalent cover.
• Do not disable services on a hunch to test a dependency theory. Set anything you changed back to its default startup type first, then retest.

Every code this article covers

Confirm the fix worked

1. Real-time scanning shows as on in the McAfee app and stays on after a restart.
2. All McAfee services show Running in services.msc with their intended startup types.
3. Windows Security under Virus & threat protection lists one active antivirus provider.
4. The System log shows no new Service Control Manager errors after a reboot.
5. The McAfee Home Page reports its protection status as secure, with no outstanding notifications.

Questions people ask about this