Skip to content

troubleshoot-live-response.md

Latest commit

 

History

History
68 lines (49 loc) · 2.67 KB

troubleshoot-live-response.md

File metadata and controls

68 lines (49 loc) · 2.67 KB

title: Troubleshoot Microsoft Defender for Endpoint live response issues description: Troubleshoot issues that might arise when using live response in Microsoft Defender for Endpoint. ms.service: defender-endpoint ms.author: chrisda author: chrisda ms.localizationpriority: medium manager: bagol audience: ITPro ms.collection:

  • m365-security
  • tier3
  • mde-edr ms.topic: troubleshooting ms.subservice: edr search.appverid: met150 ms.date: 03/26/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2

Troubleshoot Microsoft Defender for Endpoint live response issues

This page provides detailed steps to troubleshoot live response issues.

File can't be accessed during live response sessions

If while trying to take an action during a live response session, you encounter an error message stating that the file can't be accessed, take the following steps to address the issue.

  1. Copy the following script code snippet and save it as a PS1 file:

    $copied_file_path=$args[0]
$action=Copy-Item $copied_file_path -Destination $env:TEMP -PassThru -ErrorAction silentlyContinue

if ($action){
     Write-Host "You copied the file specified in $copied_file_path to $env:TEMP Successfully"
}

else{
    Write-Output "Error occurred while trying to copy a file, details:"
    Write-Output  $error[0].exception.message

}

  2. Add the script to the live response library.

  3. Run the script with one parameter: the file path of the file to be copied.

  4. Navigate to your TEMP folder.

  5. Run the action you wanted to take on the copied file.

Slow live response sessions or delays during initial connections

Live response uses Defender for Endpoint sensor registration with WNS service in Windows. If you're having connectivity issues with live response, confirm the following details:

  1. WpnService (Windows Push Notifications System Service) isn't disabled.

  2. WpnService connectivity with WNS cloud isn't disabled via group policy or MDM setting. 'Turn off notifications network usage' shouldn't be set to 1.

Refer to the following articles to fully understand the WpnService service behavior and requirements: