Carbon Black Cloud: Remote error 0x00000002 - The system cannot find the file specified
book
Article ID: 290311
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Live Response execfg command gives error:
Remote error 0x80070002 - The system cannot find the file specified.
Working directory has restricted permissions . This has been seen in directories such as:
c:\users\%username% on Windows
/ and /System on Mac
/var/log/ on Linux
Environment
Carbon Black Cloud Console: All Supported Versions
Live Response
Apple macOS: 10.15 and Above
Linux: All Supported Versions
Windows: All Supported Versions
Cause
The sensor's current behavior is to create a tmp file in the directory the command is executed. If the directory has restrictive permissions, it can cause Live Response to fail.
Resolution
Specify the output file in a different directory by using -o. Ex: