Solved

[Endpoint Security Module] Access is denied

  • 18 January 2023
  • 1 reply
  • 68 views

Badge

Hello everyone!

I have launched an Endpoint Security Assessment which has failed. The main error is “Access is denied”:

An error occurred trying to start process 'C:\Program Files\Cymulate\Agent\Executor\36.0\CymulateEDRScenarioExecutor.exe' with working directory 'C:\Program Files\Cymulate\Agent\Executor\36.0'. Access is denied.

I have slightly debugged the problem and I can confirm that the user exists on the machine as well as the exceptions made in the EDR are the following:

  • ProgramData\Cymulate\Agent\**
  • Program Files\Cymulate\Executor\**
  • Program Files\Cymulate\CLI\**
  • Program Files\Cymulate\Service\**
  • Program Files\Cymulate\Agent\*

Has anyone else experienced this error on Endpoint Security Module or in another one? How could I debug deeper this error?

Thank you very much!

icon

Best answer by David_Kellerman_CISSP 22 January 2023, 13:14

View original

1 reply

Userlevel 3
Badge +3

Hey @inakiruiz 

 

It indeed looks like something is blocking the executor from running. 

It could be the EDR or lack of permissions. 

 

I would double-check the EDR exclusions or at least try to see if there are any detections/preventions around this process.

In addition, ensure the user you’re running the assessment with has the rights to access this file.

 

If it doesn’t work, please raise a ticket with our support at support@cymulate.com.

 

Thanks, 

David

Reply