What this page covers: the messages you may see in the Guard app on a staff PC or on the Secure Access tab of the Warden dashboard, what each one means and what to do. Find the message or the symptom below. Staff can do the first checks themselves; the rest are for the office admin or IT person.
Time: 5 to 15 minutes for most problems. You need: the exact message on screen (a photo or screenshot helps), and for admin fixes, the Warden dashboard on the server.
Errors when entering the invite code
In the Prixl Guard – Setup window, a failed code shows a line like Error: invite redemption failed: server error: followed by a code word. The app shows the code word as it is, so use this table.
| Code word | What it means | What to do |
|---|---|---|
| INVITE_EXPIRED | More than 24 hours have passed since the invite was created. | Admin creates a new invite. |
| INVITE_ALREADY_REDEEMED | The code has been used already, or the admin cancelled or revoked it. | Admin creates a new invite. |
| INVITE_NOT_FOUND | The code has a wrong character in it. | Copy and paste the whole code; do not retype it. Case and spaces do not matter. |
| GUARD_PEERS_EXHAUSTED | All your organisation’s seats are in use. | Admin revokes a device that is no longer needed, or contacts Prixl for more seats. Then try the same code again if it has not expired. |
| GUARD_NOT_ENABLED or ORG_NOT_FOUND | The plan no longer includes Guard. | Admin checks the plan with Prixl. |
| A licence code word (frozen or expired) | New devices cannot be added while the licence is frozen or expired. | Admin renews the licence. |
| SERVER_NOT_FOUND, SUBNET_EXHAUSTED or IP_ALLOCATION_FAILED | The server is not registered with Guard yet, or no addresses are free. | Wait until the Secure Access tab shows the server as Active; if it already does, contact Prixl support. |
| A message starting with http: | The PC cannot reach Prixl’s service at https://api.warden.prixl.io. | Check the PC’s internet connection, proxy or firewall. |
| “Please enter an invite code.” | The box was empty. | Paste the code, then click Connect. |
Guard will not connect
Symptoms: the Guard icon stays on Connecting…, shows Connection Failed, or Windows shows “Connection lost – reconnecting…”, “Unable to reconnect to the server. Click Connect to try again.” or “Could not connect after 5 attempts”.
- Staff: check that the PC has internet. Then click the Guard icon and choose Connect. Guard retries on its own 5 times over a few minutes before it gives up.
- Admin: check that the server itself is on and has internet. If the office internet is down, nobody can connect from outside.
- Admin: on the Secure Access tab, check Connection method.
- If it is Classic Static IP: UDP 51820 must be forwarded on the router to the server. On the Network Status card, “No router IGD found – forward UDP 51820 manually” means the router did not do it automatically, and “CGNAT detected” next to External IP means it cannot work on this connection at all. In both cases switching to Prixl Magic is the quickest fix (see Change the connection method).
- If it is Prixl Magic: Guard first tries a direct connection for about 20 seconds and then switches to the automatic relay by itself, so a first connection on a difficult network can take close to a minute. If it never connects, check that the staff member’s Guard app is up to date; older versions cannot use Prixl Magic.
If staff see “Prixl Magic is unavailable on this server. Ask your admin to switch mode, then reconnect.”, Prixl Magic is not being offered for this server right now. The admin should check the licence and, if the network allows it, switch to Classic Static IP.
Guard says Connected but Remote Desktop fails
- Wrong address. Use the address after “RDP to” in the Guard icon’s tooltip or menu, which is the same as After connecting, RDP to: in the dashboard. Do not use the server’s office (LAN) address, its public address or its name.
- Remote Desktop port changed. If the dashboard shows the address with a colon and a number, type it the same way in Remote Desktop.
- Port restricted to “LAN only”. If the Remote Desktop port was restricted on the Open Ports tab with LAN only, Guard users are shut out. If the port’s row offers LAN + Guard, choose that. The tab has no button to remove a restriction, so if that option is not there, contact support. For Remote Desktop, Lock RDP to Secure Access only on the Secure Access tab is the better tool.
- Test the path. From the staff PC, open Command Prompt and type ping followed by the Guard address. The server answers pings from Guard users, so replies mean the Guard connection is fine and the problem is on the Remote Desktop side.
- Windows refuses the sign-in. That is normal Windows security, not Guard: check the username and password, and that the person is allowed to use Remote Desktop on the server.
Problems on the staff PC
- Windows asks for an administrator password every time Guard opens. Guard needs administrator permission to make its connection. On a Windows account without administrator rights, Windows may ask for an administrator’s password at each start. This is a known limitation of the current app; the staff member should ask the office IT person how to handle it on that PC.
- Guard was not running after a restart. That is expected: Guard does not start with Windows. Open it from the Start menu (Prixl Guard). With Auto-connect when Guard opens ticked (the default), it connects straight away.
- “Prixl Guard is already running. Check the system tray for the icon.” Guard is open already. Click the small ^ arrow next to the clock to find its icon.
- The connection dropped when Guard was closed. The connection only exists while Guard is open. Quit closes it.
- “A newer version of Prixl Guard is already installed.” The installer you ran is older than the app on the PC. Nothing to do; use the installed app.
- Update offered. When the menu shows Update available, click it. Guard says “Installing update – Guard will disconnect and restart automatically.”
- Mac, iPhone or Android. Guard runs only on Windows 64-bit today.
Messages on the Secure Access tab
| Message | What to do |
|---|---|
| Not Available on Your Plan (tab greyed out) | Guard needs the Warden + Guard plan (the dashboard calls this the Business Guard plan). Use Contact Prixl to Upgrade. |
| Guard server is not yet registered. The agent will set it up automatically. | Wait; Warden is setting Guard up. If it does not change, check the server’s internet and contact support. |
| Cannot create invites – 10 pending (max 10) | Cancel unused invites in Pending Invites, or wait for them to expire. |
| All N of M Guard seats are in use across your whole organisation… | Revoke a device you no longer need; see Revoke access. |
| Cannot revoke the last active peer. Create a new peer first to avoid lockout. | Invite another device and have it enter its code, then revoke. |
| Cannot lock RDP – no Guard peers are configured… | Have at least one person enter an invite code first; see Lock Remote Desktop safely. |
| RDP lock is configured ON but NOT active… | Turn Lock RDP to Secure Access only off and on again and click Save Settings, or contact support. |
| RDP is temporarily open because no Guard peer is connected (your unlock-on-drop setting)… | Expected when Auto-unlock on tunnel failure is on. It locks again when someone connects through Guard. |
| …your clients may be on an old server key – re-issue their invites (or update the Guard client)… | Shown after Warden was reinstalled. Create new invites for staff, or have them update Guard. |
Locked out of Remote Desktop
With Lock RDP to Secure Access only on and Auto-unlock on tunnel failure off (the default), Remote Desktop stays closed to the internet if Guard is not working. You can still get in from the office network, from a Trusted IP, or through your cloud provider’s console. From there, fix Guard or turn the lock off and click Save Settings. If you have no way in at all, use the contact form: Prixl support can send an emergency unlock, your admins get an email “Emergency Remote Desktop unlock requested”, and it takes effect within about 5 minutes.
Licence problems
- Frozen licence: adding new devices, revoking and hardening changes are paused. Renew to restore everything.
- Expired licence: staff on Classic Static IP keep working; staff on Prixl Magic are disconnected within minutes. Renew, or switch the connection method if the network allows it. See Trial, licence renewal and what happens at expiry.
What to send to support
Use the contact form with a photo or screenshot of the message, the connection method shown on the Secure Access tab, a screenshot of the Network Status card, and the Guard log from the staff PC. To find the log, press the Windows key and R together, paste the line below and press Enter; the file is guard.log.
%LOCALAPPDATA%\Prixl\GuardNext
Previous: Change the connection method. Background: How Guard works. Back to Prixl Guard (Secure Access) guides.