Remote Error 0x80070002 When Using Reg Commands With Live Response

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Remote error 0x80070002 - The system cannot find the file specified. When trying to use Reg Commands like reg query

Environment

• Carbon Black Cloud Windows Sensor: All Supported Versions
• Windows OS: All Supported Versions

Cause

This can happen if the requested registry key doesn't exist or when not surrounding a registry path that contains spaces with ""

Resolution

• Run reg query PARENTPATH\ to display all existing registry keys to confirm the requested registry key exists
• Any registry path that contains spaces must have quotes around it

Live Response for device 59289986
[59289986] C:\Windows\system32> reg query -v HKLM

Remote error  0x80070002 - The system cannot find the file specified.

[59289986] C:\Windows\system32> reg query HKLM
Subkeys:
   BCD00000000
   HARDWARE
   SAM
   SECURITY
   SOFTWARE
   SYSTEM
[59289986] C:\Windows\system32>

 

Additional Information

reg query HKLM\System\ will show all the registry keys that exist in System
the "reg -v" option can only be used with keys, not their parent hive/folder names alone