Carbon Black Cloud: Live Response Remote error 0x00000002 When Running "execfg Dascli Status"

Products

• Carbon Black App Control (formerly Cb Protection)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Carbon Black Cloud and App Control installed
• Live Response execfg command "dascli status" gives error:

  Remote error 0x80070002 - The system cannot find the file specified.

Environment

• Carbon Black Cloud Console
  • Live Response
• App Control Agent: All Supported Versions

Cause

This has been seen when third party AV vendors are missing their App Control exclusions. 

Resolution

1. Add the required exclusions:
   • https://community.carbonblack.com/t5/Knowledge-Base/App-Control-Anti-Virus-Exclusions-for-Agent-Windows/ta-p/38334
2. Re-attempt the command