- The easiest way to remove read-only files and folders is to use sdelete: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete
- Download and extract the sdelete.exe/sdelete64.exe files to the local workstation from the link above.
- Use the 'put' command in the Live Response session to send the sdelete executable to the sensor :
put <destination_location>
- Change directories to the 'destination_location' above.
cd <destination_location>
- Run sdelete.exe command from Live Response.
execfg sdelete.exe /accepteula -r "<directory/file_to_delete>"
- Switches:
- /accepteula : Accepts EULA without prompting via GUI
- -r : Recurse subdirectories (if applicable)