It was the default domain policy that contained the permitted accounts that can run as a service. I had to add the account used to deploy the AV to the permitted accounts.
