SEDR cloud Dissolvable Agent Server returns Network Path not Found

Products

• Endpoint Detection and Response Cloud
• Endpoint Detection and Response

Issue/Introduction

When performing a data collection job, an error may be seen for "RemoteServiceRunner" in the Dissolvable Agent Server logs.

53 - The network path was not found

Cause

Windows scans require the presence of default administrative shares Admin$ and C$ in order to succeed to collect the requested data.

Resolution

Check that Admin$ and C$ are present for the target asset, by running the command "net share". If these are missing, you can enable proper creation of these share, by editing (or adding, if missing) these registry keys and restarting the server service:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareWks

The registry subkeys AutoShareServer and AutoShareWks must be set as type REG_DWORD with a value of 1.

Run the command "net server stop", then "net server start" to restart the server service.