CB Defense: "Remote Error 0x8000FFFF - Catastrophic Failure" When Using Live Response with Sensor 3.3 and Higher

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Live Response error:
 

Remote error 0x8000FFFF - Catastrophic failure

Environment

• CB Defense PSC Console: All Versions
• CB Defense PSC Sensor: 3.3 and 3.4

Cause

The Live Response memory dump capability is disabled by default in Windows sensor version 3.3.

Resolution

Upgrade to Carbon Black Cloud sensor 3.5

Additional Information

• The Live Response "memdump" command may cause crashes in sensor version 3.3 and 3.4
• This error may also happen if a full filepath and filename are not being provided.