Backup Policies

Backup scheduling is managed through Configuration Policies. You create a policy, add a Backup feature link, configure the backup mode and targets, then assign it at any level of the hierarchy — organization, site, device group, or individual device. The policy system resolves which devices get which backup settings using the same precedence rules as other features.

---

Creating a Backup Policy

1. Go to Settings > Configuration Policies.

2. Click Create Policy (or edit an existing one).

3. In the policy editor, click Add Feature and select Backup.

4. Configure the backup settings:

   Backup Mode — choose one per policy:

   Mode	What it backs up
   File (default)	Selected directories and files with include/exclude path rules
   Hyper-V	Virtual machines on Hyper-V hosts
   MSSQL	SQL Server databases
   System Image	Full system state capture

   Storage Configuration — select which storage target to use (created in Storage Configuration).

   Schedule — frequency (daily, weekly, monthly), time of day, timezone, and optionally day-of-week or day-of-month.

   Retention — Grandfather-Father-Son (GFS) settings:

   • Daily snapshots to keep
   • Weekly snapshots to keep
   • Monthly snapshots to keep
   • Yearly snapshots to keep (for compliance)

5. Assign the policy to organizations, sites, device groups, or individual devices.

6. Click Save.

---

How Policy Assignment Works

Backup policies follow the same hierarchical precedence as all configuration policies:

Device (most specific) > Device Group > Site > Organization (least specific)

A device-level assignment overrides a site-level one. If a device has no direct assignment, it inherits from its device group, then site, then organization.

Tip

Assign backup policies at the site or organization level to protect new devices automatically as they enroll. Use device-level overrides only for exceptions (e.g., a server that needs more frequent backups than the site default).

---

Backup Modes in Detail

File Backup

The default mode. Specify which paths to include and exclude:

• Include paths — directories to back up (e.g., C:\Users, /home)
• Exclude paths — skip specific subdirectories or patterns (e.g., C:\Users\*\AppData\Local\Temp)

On Windows, file backups automatically use Volume Shadow Copy (VSS) to capture application-consistent snapshots of open files.

Exclude patterns follow gitignore-style rules (Windows \ separators are accepted and treated as /):

Pattern shape	Matches
No slash — *.tmp, Thumbs.db	The name of any file or folder at any depth.
Contains a slash, no leading / — node_modules/**, AppData/Local/Temp/**	That relative path at any depth below the backup root.
Leading / — /proc/**, /swapfile	Only that path directly under the backup root (root-anchored). Since v0.112.0; previously a leading / was ignored and the pattern matched at any depth.

** matches zero or more path segments, a pattern that matches a folder skips the whole subtree, and matching is case-insensitive on Windows only. A trailing / carries no special meaning (foo/ is the same as foo). Invalid patterns are logged and ignored rather than failing the backup.

What a file backup preserves (agent v0.112.0 and later): regular files, symbolic links (as links, never followed), empty and specially-permissioned directories, owner and group, and the full permission bits including setuid/setgid/sticky. Sockets, FIFOs and device nodes are skipped. Ownership and the special bits are reapplied on restore only when the restore runs as root (never on Windows); otherwise the restore prints one summary warning and keeps the files. A snapshot that records any of these extras is written in a newer manifest format that older agents cannot restore correctly — restore it with a v0.112.0 or later agent. Snapshots containing only plain files are unchanged.

Hyper-V Backup

Targets Hyper-V virtual machines. Uses all-by-default targeting — newly discovered VMs are automatically included on the next scheduled run. You can configure exclude lists to skip specific VMs.

Two consistency modes:

• Application-consistent (default) — uses Hyper-V’s VSS integration for clean VM snapshots
• Crash-consistent — saves VM state before export, faster but less clean

SQL Server Backup

Targets SQL Server databases. Like Hyper-V, new databases are automatically included. Supports three backup types in a chain:

• Full — complete database backup
• Differential — changes since last full backup
• Log — transaction log for point-in-time recovery

System Image

Captures the OS state needed to rebuild a machine’s configuration — registry hives, boot configuration, certificate store, drivers, services and firewall policy on Windows; /etc, the package list, enabled services, firewall rules and crontabs on Linux; preferences, launch items and network configuration on macOS — plus, on Linux and Windows, the disk layout used to judge whether the snapshot is bare-metal restorable. Used for bare metal recovery; turning on whole-machine backup for this source also walks the root filesystem in the same snapshot (the Whole machine profile templates do this) for a full rebuild in one snapshot.

---

Bandwidth and Scheduling Controls

Policies support additional controls for managing backup impact:

Setting	Description
Backup window	Time range during which backups are allowed to run
Bandwidth limit	Maximum throughput in Mbps to avoid saturating the network
Priority	Controls ordering when multiple devices are scheduled simultaneously

---

Monitoring Policy Coverage

The Backup dashboard Overview tab shows:

• Devices Protected — count of devices assigned to at least one backup policy
• Devices Needing Backup — devices with overdue or missing backups

Individual device status is visible on each device’s Backup tab, showing the assigned policy, last successful backup, and next scheduled run.