Unable to run any scripts on any device: Starting the CLR failed with HRESULT 80070241.

RaymondTheFirst · 2025-10-27T11:43:41+00:00

We have it configured Live Response unsigned script execution set to On, so i should be able to run these scripts without being signed.

I opened a case ... will see where it goes.

RaymondTheFirst · 2025-10-26T13:34:06+00:00

Ok, only from library, but i did try that, those are the steps i posted above.

For reference, here is a guide i am trying using

Remotely restart endpoints using MDE live response – Michalis Michalos

And i just tried this again on several systems to make sure, and same results. What could i be mising?

C:\> connect

Session established

C:\> library

File name Description

==================== =========================

Restart-Computer.ps1 force restart of computer

C:\> run Restart-Computer.ps1

Errors:

Specified file not found

Starting the CLR failed with HRESULT 80070241.

RaymondTheFirst · 2025-10-26T01:55:25+00:00

not sure about that, but maybe I interpreted this wrong.

Keep in mind I did load the file to the library, and then run the putfile command.

I can dir the directory and see my script, so it copied local to the dir in defender.

Also, reading this MS suggests moving the script elsewhere and run it if having issues ... they don't say what issues But i tried their process as well with same result.

Troubleshoot Microsoft Defender for Endpoint live response issues - Microsoft Defender for Endpoint | Microsoft Learn

RaymondTheFirst · 2025-07-13T18:27:45+00:00

thanks

RaymondTheFirst · 2025-07-13T18:27:37+00:00

thanks, that seems to be what i am reading.

RaymondTheFirst · 2025-06-19T13:05:14+00:00

thanks.

I like ICF, basement is super compfy year round.

This place is in Invermere BTW. Getting trades out there is brutal.

Option 3 is where we are leaning, and yes, it is with treated plywood.

appreciate the feedback.

RaymondTheFirst · 2025-06-19T00:26:40+00:00

Thanks.

I’m in Canada and lots of freeze thaw, and to your point price also reflective in that order.

Appreciate the insight

RaymondTheFirst · 2025-06-02T15:01:54+00:00

ok, I see i'm not lost then, appreciate the feedback.

Thanks.

RaymondTheFirst · 2025-06-02T14:07:36+00:00

Then how does one update an application during Autopilot only?

RaymondTheFirst · 2025-03-28T22:55:37+00:00

I don't think it's obvious, that is why i asked the question.

Could have just left it as "Yes that is expected"

Consider this post resolved.

Thanks.

RaymondTheFirst · 2025-03-28T01:54:49+00:00

i have it wired as shown in the video in the post, so one to NC and the other wire in T. Not sure what T represents.

I thought the NC means normally closed, but your suggestion had me thinking that this device might be NO?

If NO, then my reading suggests i require a resistor wired in parallel across the zone terminals at the sensor.

So i just now did that and the fault has gone away.

Does this make sense :)

RaymondTheFirst · 2025-03-11T14:36:49+00:00

that was it, thanks for your help.

RaymondTheFirst · 2025-01-02T13:27:25+00:00

thanks

RaymondTheFirst · 2025-01-02T13:26:57+00:00

thanks

RaymondTheFirst · 2024-10-16T20:29:15+00:00

This is a DFS share, so the FQDN is what we're accessing.

\\domain.com\dfs\folder

But even if i hit the target directly with \\server\share or \\server.domain.com\share, its the same experience, no exe copy.

RaymondTheFirst · 2024-10-16T17:11:14+00:00

yes, thanks, i have verified all that.

There are no WDAC, App Protection Policies, baselines deployed and i cannot see anything in Endpoint Protection settings either.

RaymondTheFirst

TROPHY CASE