Retention

Retention decides which backups stay in the vault and which are deleted. It runs on the storage machine, as a sweep on a regular interval and whenever an incoming backup needs room. It is the only way a backup is ever deleted.

Retention has two jobs that pull in opposite directions: keep enough history that a backup from before a compromise is still there when you need it, and keep the vault from filling. The settings below balance them. An attacker who can cause backups can also fill the vault, so filling the vault must never be a way to delete the clean backups an attacker would want gone.

Retention settings

Retention settings are on the Storage agents tab of the Configuration screen, in the Vault retention group. Two of them can be set only on the storage machine itself.

Setting	What it does
Retention floor	An age, in days. Nothing younger than the floor is deleted to make room for an incoming backup. It defaults to the Active Directory tombstone lifetime of 180 days. Set on the storage machine only.
Minimum versions per DC	No rule, for any reason, takes a domain controller below this many versions. It is at least 1, so a machine's only backup is never deleted. Set on the storage machine only.
Maximum version age	A ceiling: versions older than this are deleted. `0` keeps them indefinitely.
Maximum versions per DC	A ceiling: how many versions to keep for each domain controller, however recent they are. `0` means no limit. Which versions survive is decided by the retention mode.
Retention mode	`newest` or `thinned`. Decides which versions the count ceiling and a full vault delete. See Retention modes.
Free space reserve	Free space kept on the volume beyond what an incoming backup needs, so that the volume never fills completely.
Sweep interval	How often the scheduled retention sweep runs.
Dry run	Selects and reports what retention would delete, without deleting anything.

For defaults, ranges, and configuration keys, see Settings Reference.

Floors and ceilings

The settings fall into two kinds, and they bind different things:

The floors protect—Minimum versions per DC binds every deletion: no ceiling, mode, or full vault takes a machine below it. Retention floor binds space pressure only: when the vault is full, nothing younger than the floor is deleted in newest mode.
The ceilings delete—Maximum version age and Maximum versions per DC ask for deletion. When you set them on the storage machine, they decide how deep the history actually goes, even inside the retention floor. A maximum you set is a maximum.

Note: Important: The retention floor does not by itself keep 180 days of history. Whenever a ceiling is set, the ceiling decides the real depth. Check Maximum versions per DC and Maximum version age against the history you need, which for a ransomware response is usually the attacker's likely dwell time plus a margin, up to the tombstone lifetime.

Settings that only the storage machine can weaken

Most storage agent settings are held by the Manager and pushed to the storage agents, which keep using the last values they received if the Manager is unreachable. Retention is treated differently, because the Manager is on the network and the storage machine is deliberately isolated from it:

Local-only settings—Retention floor and Minimum versions per DC are read only from the storage agent's own configuration on the storage machine. The console shows what each storage agent reports, marked Set on the machine, and the Manager refuses any attempt to set them.
Clamping—For every setting that decides whether a backup is deleted, the storage agent compares the value it receives from the Manager with its own and uses the more protective of the two. A value sent from the console can tighten retention but never weaken it. For example, a Maximum version age sent from the console that falls inside the storage machine's floor is raised to the floor. The storage agent reports every clamp, and the Configuration screen shows the value that was sent beside the value in use.

To weaken retention below what the storage machine allows, you must change the storage agent's own configuration on that machine.

Changing a setting that can delete backups from the console asks you to review the change and type CONFIRM before it is saved. Every retention change is recorded in the audit trail as Retention changed.

Retention modes

Newest

In newest mode, the default, the count ceiling keeps each domain controller's most recent versions and deletes the oldest first. When the vault is full, retention deletes only versions older than the retention floor. If that does not free enough room, the incoming backup is refused rather than a version inside the floor being deleted.

A refused backup raises the Vault refusing backups alert, which you can act on. A deleted clean backup cannot be recovered.

Thinned

In thinned mode, retention keeps each domain controller's newest version and its deepest version inside the retention floor, and deletes from between them, choosing whichever deletion leaves the smallest gap for its age. Versions older than the floor are deleted first. What survives is dense near today and sparse toward the floor, so a small number of versions spans the whole floor.

As versions age out at the bottom, thinning keeps the chain without a gap wider than the floor divided by (maximum minus 4), so another version is always close enough to the floor to take over as the deepest.

The trade: under space pressure, thinned mode can delete versions inside the retention floor, where newest mode refuses the backup instead. It only takes versions from the middle, never the newest or the deepest, so a full vault costs granularity rather than depth. Neither mode takes a domain controller below Minimum versions per DC.

Worked example

Consider a domain controller backed up once a day, with a retention floor of 180 days and Maximum versions per DC set to 10.

	Newest	Thinned
Versions kept	The 10 most recent	10, spread from today back toward the floor
History covered	About 10 days	The whole 180 days; the deepest version stays above about 150 days old
Widest gap between versions	1 day	No more than 30 days (180 ÷ (10 − 4))
When the vault is full	Deletes only versions older than 180 days; otherwise refuses the new backup	May delete versions from the middle of the 180 days; keeps the newest and the deepest

If an attack went unnoticed for 60 days, newest mode in this example would hold no backup from before it, while thinned mode would still hold several. A smaller maximum gives wider gaps and a shallower worst case.

Space pressure

Before an incoming backup starts, the storage agent reserves room for it: the Manager's size estimate from the machine's recent backups, plus a margin, plus the free space reserve. The reservation stops concurrent backups from each passing a free-space check and then together overrunning the volume. If there is not enough room, retention runs under space pressure as described for each mode. The Repository screen shows capacity and each retention action, including whether it was a scheduled sweep or space pressure, and any backup that was refused.

Dry run

With Dry run on, retention selects and reports what it would delete, but deletes nothing. Use it to see what a new policy would remove before letting it run. The Repository screen shows a notice while retention is in dry run, and marks the previewed deletions.

Dry run is the more protective state, so if it is set on the storage machine, it cannot be turned off from the console.