Carbon Black Cloud: Remote error 0x00000002 - The system cannot find the file specified
search cancel

Carbon Black Cloud: Remote error 0x00000002 - The system cannot find the file specified

book

Article ID: 290311

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Live Response execfg command gives error:
    Remote error 0x80070002 - The system cannot find the file specified.
  • Working directory has restricted permissions . This has been seen in directories such as:
    • c:\users\%username% on Windows
    • / and /System on Mac
    • /var/log/ on Linux

Environment

  • Carbon Black Cloud Console: All Supported Versions
    • Live Response
  • Apple macOS: 10.15 and Above
  • Linux: All Supported Versions
  • Windows: All Supported Versions

Cause

The sensor's current behavior is to create a tmp file in the directory the command is executed. If the directory has restrictive permissions, it can cause Live Response to fail.

Resolution

​​​​​​Specify the output file in a different directory by using -o. Ex:
execfg whoami -o "Path/to/filename.log"