Carbon Black Cloud: Remote error 0x00000002 - The system cannot find the file specified

[#1]

Environment

• Carbon Black Cloud Console: All Supported Versions
  • Live Response
• Apple macOS: 10.15 and Above
• Linux: All Supported Versions
• Windows: All Supported Versions

Symptoms

• Live Response execfg command gives error:

  Remote error 0x80070002 - The system cannot find the file specified.

• Working directory has restricted permissions . This has been seen in directories such as:
  • c:\users\%username% on Windows
  • / and /System on Mac
  • /var/log/ on Linux

Cause

The sensor's current behavior is to create a tmp file in the directory the command is executed. If the directory has restrictive permissions, it can cause Live Response to fail.

Resolution

Specify the output file in a different directory by using -o. Ex:

execfg whoami -o "Path/to/filename.log"

Related Content

Carbon Black Cloud: Live Response Execfg Commands Fail on Mac