Sizing Backup Storage

The storage machine's volume holds every backup that retention keeps, plus room for the backups that are running. This topic explains what drives the size and how to measure it from your own domain controllers with cdr repository estimate.

What drives the size

Every backup is a full copy—Backups are not incremental. A full system backup copies the used space on each domain controller's critical volumes: the volumes that hold Windows, the boot files, the directory database and its logs, SYSVOL, and the files of installed services.
How many domain controllers you back up—Each one you back up adds its full backup size for every version kept. You don't have to back up every domain controller; a recovery can restore some and rebuild the rest. For which ones to choose, see Choosing Which Domain Controllers to Back Up, and size that set with --per-domain.
How many versions you keep—Retention settings decide how many backups of each domain controller stay in the vault. See Retention.
Backups in progress—Staging and the vault share one volume, so backups being written take space alongside the stored history. The storage agent reserves room for each backup before it starts.
Free space reserve—The storage agent keeps a minimum amount of free space that no backup may use.
The Manager's configuration backups—The storage machine also keeps the Manager's daily configuration backups, on the same volume, beside the vault. Each is roughly the size of the Manager's database, compressed, and the storage machine caps the folder with its own size limit.

DC state backups are smaller than full system backups, but they support only DC state recovery. The estimate assumes full system backups, which support every recovery method. For the difference, see Backup Types.

How the estimate works

cdr repository estimate reads the list of domain controllers from the directory, then connects to each one and reads its volumes. It changes nothing on any machine and does not contact the Manager, so you can run it before you deploy any agents.

For each domain controller, it calculates the backup size as the used space on the critical volumes, minus the files that Windows Server Backup leaves out (the paging file, the hibernation file, and shadow copy storage), plus an allowance for backup image overhead (15% by default).

It then calculates the volume size:

Retained backups—The sum of every domain controller's backup size, multiplied by the number of versions kept for each.
Backups in progress—The largest domain controllers' backups, as many as can run at once, plus the margin the storage agent adds when it reserves room for a backup.
Free-space reserve—The storage agent's reserve.
Required—The total of the three. This is the smallest volume that can accept the next backup when the stored history is at full depth.
Recommended—Retained backups and backups in progress increased by a growth allowance (25% by default), plus the reserve.

Unless you override them, the number of versions, the number of concurrent backups, the margin, and the reserve come from the product's default settings. The output always states the assumptions it used. For the defaults, see Settings Reference.

Requirements for running the estimate

The cdr tool on Windows—cdr.exe is installed in the Manager's program folder. It runs without installation, so you can copy it to the machine where you run the estimate.
A domain-joined machine—Run the command from a Windows machine joined to a domain in the forest. You can run it from a machine outside the domain if you give an account with --user and a domain controller with --server, and the machine's DNS resolves the domain.
An administrator account on the domain controllers—By default, the command uses your own sign-in. To use another account, give it with --user, naming the domain by its DNS name, such as admin@corp.example.com or corp.example.com\admin. The password is read from the CYGNADR_ESTIMATE_PASSWORD environment variable, or you are prompted for it.
Kerberos—The command authenticates only with Kerberos. The machine's clock must be within five minutes of the domain's, and its DNS must resolve the domain's own zone.
Remote access to the domain controllers—WinRM on TCP 5985 (the default), or DCOM on TCP 135 and the dynamic RPC ports with --transport dcom.

When you name an account with --user and list domain controllers with --dc, the command tries the account on one domain controller first. If that domain controller refuses it, the command stops instead of sending a possibly wrong password to every domain controller and locking the account out.

Running the estimate

To estimate backup storage:

On a domain-joined Windows machine, open a command prompt in the folder that contains cdr.exe.
Run the estimate for the whole forest:
```
cdr repository estimate
```
The command lists each domain controller as it is measured, then prints the results.
Optionally, run it again with your planned settings. For example, to keep 7 daily versions of 3 domain controllers in each domain, with an administrator account in the forest root domain:
```
cdr repository estimate --versions 7 --per-domain 3 --user admin@corp.example.com
```

Common options

Option	Description
`--dc <FQDN>`	Measures only this domain controller. Repeat for more. Without it, every domain controller in the forest is measured.
`-d`, `--domain <FQDN>`	Measures only the domain controllers of this domain.
`-s`, `--server <DC>`	The domain controller to read the list of domain controllers from.
`-u`, `--user <ACCOUNT>`	An administrator on the domain controllers, with the domain given by its DNS name.
`--versions <N>`	Backups kept per domain controller, as in the Maximum versions per DC setting. 0 means no count limit.
`--days <N>`	The age limit for backups in days, as in the Maximum version age setting. 0 means no age limit.
`-e`, `--every <MINUTES>`	How often each domain controller is backed up, used with `--days`. The default is 1440 (daily).
`--per-domain <N>`	Backs up N domain controllers in each domain instead of every one, each sized at the domain's average.
`--concurrent <N>`	Backups running at once, as in the Maximum concurrent backups setting.
`--overhead <PERCENT>`	Image overhead added to the copied space. The default is 15.
`--growth <PERCENT>`	Growth allowance in the recommended size. The default is 25.
`--volumes`	Lists every volume of every domain controller, with what was left out and why.
`--json`	Writes the results as JSON instead of tables.

If you give both --versions and --days, the stricter limit applies, as it does in the vault. For the complete list of options, see Storage and Media Commands.

Reading the output

The first table has one row per domain controller:

Column	Shows
DC	The domain controller's name. Read-only domain controllers are tagged `RODC`.
DOMAIN, SITE, OS	Where the domain controller is and what it runs.
CRITICAL VOLUMES	The volumes a full system backup includes.
USED	The used space on those volumes.
LEFT OUT	Space that Windows Server Backup does not copy: the paging file, the hibernation file, and shadow copy storage.
BACKUP	The estimated size of one full backup. A domain controller that could not be read shows `not measured` and the reason.

Below the table, a line starting with Assumes states the retention, concurrency, margin, reserve, and overhead used. The summary table then shows Retained backups, Backups in progress, Free-space reserve, Required, and Recommended. Provision at least the recommended size.

Pay attention to the warnings after the summary:

Domain controllers that were not measured—They are not in the main totals. An extra summary row shows the recommended size if each one is as large as the largest domain controller that was measured. Fix the cause and run the estimate again, or use that row.
NOT IN ANY TOTAL—Domains where no domain controller could be reached. This is usually a domain that no longer exists but is still defined in the directory. If the domain is live, fix access and run the estimate again.
NOT MEASURED—Domains whose domain controllers answered but could not be read, usually because the account is not an administrator there. Run the estimate again with --user and an account that is.

The command exits with code 7 if any domain controller was not measured, and 0 if all were.

Note: The estimate does not include your Windows Server installation media or the recovery images. If you keep them on the same volume, allow a few gigabytes for each Windows Server version.

After you deploy

Once backups are running, the Repository screen shows the vault's real capacity, free space, and retention depth for each domain controller, and cdr repository status shows the same from the command line. See Repository.