diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response-command-examples.md b/windows/security/threat-protection/microsoft-defender-atp/live-response-command-examples.md index c431ecb195..89649bba47 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response-command-examples.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response-command-examples.md @@ -95,6 +95,19 @@ getfile c:\Users\user\Desktop\work.txt getfile c:\Users\user\Desktop\work.txt -auto ``` +>[!NOTE] +> +> The following file types **cannot** be downloaded using this command from within Live Response: +> +> * [Reparse point files](/windows/desktop/fileio/reparse-points/) +> * [Sparse files](/windows/desktop/fileio/sparse-files/) +> * Empty files +> * Virtual files, or files that are not fully present locally +> +> These file types **are** supported by [PowerShell](/powershell/scripting/overview?view=powershell-6/). +> +> Use PowerShell as an alternative, if you have problems using this command from within Live Response. + ## processes ``` # Show all processes