CB Response: Cannot Delete Read-Only Files and Folders With Live Response
search cancel

CB Response: Cannot Delete Read-Only Files and Folders With Live Response

book

Article ID: 287422

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • The 'delete' command inside of a Live Response session gives the following errors when attempting to remove files or directories:
    • "Remote error HRESULT 0x80070005" = 0x80070005: Facility[WIN32] Code[0005] Severity[1] Access is denied.

Environment

  • CB Response Server: All Supported Versions

Cause

  • Read-only flags are set on files and directories.  The error generated is being given by the OS, due to the files being read-only.

Resolution

  • The easiest way to remove read-only files and folders is to use sdelete: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete 
    • Download and extract the sdelete.exe/sdelete64.exe files to the local workstation from the link above.
    • Use the 'put' command in the Live Response session to send the sdelete executable to the sensor : 
put <destination_location>
  • Change directories to the 'destination_location' above.
cd <destination_location>
  • Run sdelete.exe command from Live Response.
execfg sdelete.exe /accepteula -r "<directory/file_to_delete>"
  • Switches:
    • /accepteula : Accepts EULA without prompting via GUI
    • -r : Recurse subdirectories (if applicable)