Security Essentials: restore a quarantined file to a different location?

Question

I have a file that Security Essentials quarantined "on sight" that I want to restore to perform some further analysis on.

However, the file was stored on my NAS server. This means I had accessed the server by entering \\192.168.1.5 into my Run box, entering the credentials and browsing to the folder. Security Essentials removed the item and stored it in quarantine. I am unable to restore the item from quarantine, with the error code 0x80508014.

My research shows that this error indicates that SE can't access the path the original file was in, and suggests recreating the path. The problem is that I haven't removed any folders so the path already exists. Further digging seems to indicate that the issue is that SE cannot access the network share because the share is connected to my user account session and not to SYSTEM or Administrator. SE lists the path of the original file in the details as file:\\192.168.1.5\storage\research\file.exe, so it appears SE is trying to directly restore the file to this location and is unable to do so because the SE process does not have access to the share connection.

I tried opening an Administrator command prompt and manually connecting the network share to Admin's session using net use but this did not help.

Is there a way to direct SE to restore a quarantined file to a different location than it was originally found in? I do not see a way for me to be able to give the SE process access to the network share so it can restore the file.

Answer 1

I hit a similar problem when Windows 10 Defender quarantined some files from my NAS box.

In a Command Prompt (opened as administrator) I was able to use the command line tool to list the quarantined files:

c:\Program Files\Windows Defender>MpCmdRun.exe -restore -listall

The following items are quarantined:

XXX
XXX

Then I used the -restore option along with -Path to restore to a local path:

c:\Program Files\Windows Defender>MpCmdRun.exe -restore -All -Path C:\Path\To\Restore

After that I was able to copy the files back to my network drive (which is now on the exclusion list!).

Answer 2

When you ran the net use command from the administrative command prompt, did you then also run/launch the SE interface from that command prompt?

net use \\192.168.1.5\ipc$ /user:username pwd
net use \\192.168.1.5\storage /user:username pwd
"C:\Program Files\Microsoft Security Client\msseces.exe"

In my experience this is required because the SE process must not only run under the same user ID, but the same session. If you run net use from an administrative command prompt it may not have any effect on the administrative SE app if SE was launched separately from the command prompt.