CB Defense: Live Response Error "Remote error 0x80070005 - Access is denied"

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

 Errors using Live Response commands on a directory

Remote error 0x80070005 - Access is denied.

Environment

• CB Defense PSC Console: All Versions
• CB Defense PSC Sensor: All Versions
• Microsoft Windows: All Supported Versions

Cause

Folder is a junction, shortcut, or symbolic link to an original path

Resolution

1. In Live Response, navigate to directory above the one that prompted the "Remote error 0x80070005 - Access is denied."
2. Run the following command:

   execfg cmd.exe /C dir /AH
   

3. Output of this command will show  <JUNCTION> as well as Folder name and original path
4. Navigate to the original path in Live Response and take Live Response action from original directory