Backup & Restore

License

MA-BKR

MA-BKR

Operating System

Windows

Windows

Supported Devices

Windows devices running MetaDefender Endpoint version 7.6.2607.xxx or later. Non-Windows devices and devices on older versions are automatically excluded from any target you select.

Windows devices running MetaDefender Endpoint version 7.6.2609 or later. Non-Windows and older version devices are excluded.

Storage

You need at least one reachable storage destination (for example a shared folder path such as \\server\share). An unreachable or misconfigured destination is rejected when you create the job.

At least one successful backup of the source device, taken on M OPSWAT Central Management 10.7.26092 or later.

Dashboard

See fleet-wide backup coverage, run statuses, top failure reasons, and the devices that need attention

Backup

Create and manage backup jobs, including two tabs:

1. Active Jobs lists every backup job that is currently set up, with its status, target, schedule, and a per-status device count. This gives you a quick view of how the latest run is going across all targeted devices

When a job finishes a run, it moves automatically to the History tab. If the job is recurring (Hourly, Daily, Weekly, or Monthly), a new active job is created automatically to handle the next scheduled run

2. History tab records each completed run with its start and end time and the number of devices that ended in each status. Use it to audit past backups and confirm whether they succeeded

Devices

Lets you browse the backups that have been stored by device, as well as the backup scope, destination, size, and the time of the last backup for each device

File Browser

Shows what has actually been stored by file, you can see the backup scope, destination, size, and the time of the last backup for each device

Restore

Create and manage restore jobs. The job list shows restores that are scheduled or in progress, and the History tab records finished restores.

Reports

Automated and on-demand report definitions (PDF/CSV) with scheduled stakeholder email delivery

Notifications

Scheduled

The job is enabled and waiting for its next scheduled run

In Progress

A run is underway and devices are backing up

Stopped

The job has been stopped manually and will not run until you start it again

Step 1: Enter a job name and description

The job name must be unique within your account; a duplicate name will be rejected

Step 2: Choose target devices to back up

Please note only Windows devices running MetaDefender Endpoint 7.6.2607.xxx or later can be backed up.

1. All Groups applies to every device group

2. Specific Groups applies only to the groups you pick

3. Specific Devices applies only to the individual devices you select

Step 3: Configure Backup Scope and Backup Mode

1. Backup Scope is currently fixed to Full Image. It captures all volumes needed to restore the operating system, including the system, boot, and recovery partitions; non-OS data volumes are excluded

2. Backup Mode: Select preferred backup mode

   1. Full: captures all selected data on every run. Because every run stores a complete image, make sure your destination has enough free space

   2. Incremental: the job's first run still captures a complete (full) image; every run after that captures only what changed since the previous backup, so it finishes faster and takes less space. A full backup plus the incremental backups that follow it form a chain

Step 4: Configure Backup Destination

Choose where backups are stored:

1. Mirror sends the backup to all destinations at the same time

2. Failover sends it to the primary destination and falls back to the others if that one is unavailable.

3. For each destination, pick a Type and enter the path

   1. Shared Folder: enter the UNC path (for example \\server\share)

   2. Vault: select a pre-configured Storage Vault to store backups in a managed, cataloged repository. To set one up first, see Storage Vault Catalog

4. Use Add Destination to add more. An unreachable or misconfigured destination will be rejected

Step 5: Set up a schedule when backups run on target devices

1. Frequency can be Once, Hourly, Daily, Weekly, or Monthly; depending on the choice, the form asks for the matching details (for example days of the week for Weekly, or a day of the month for Monthly)

2. For Timezone, choose Local device time to run by each device’s own local time, or pick a specific timezone (such as UTC+7) so all devices run at the same moment. For a one-time schedule, the system rejects a start time that is already in the past

3. Max Backup Duration (optional) limits how many hours a backup may run on a device. If a device exceeds this window before finishing, that run is marked Failed. If you leave it empty, a default limit of about 24 hours applies

   

Step 6: Complete

Click Create to save the job, or Discard to cancel

Clone

Duplicate the job's settings into a new job

Stop

Stop a running or pending job. Devices that are backing up receive a stop command and are marked as failed by force stop, while devices that have not yet started are removed from the queue. A stopped job can be started again with Start, which recalculates the next run time from the schedule

Edit

Change the job's settings, such as its schedule or targets

Delete

Remove the job. You cannot delete a job while it is running, so stop it first

Full

Only that backup's files

Incremental

Downloads the full chain required to restore to that point, starting from the original full backup, through each increment, up to and including your selected one.

Example: In a chain Full → 1 → 2 → 3 → 4, selecting increment 2 downloads Full, 1, and 2 only.

Progressive loading

Only the current folder's contents load at a time

Incremental backups

The tree shows the complete captured contents up to that point in time, not just the files that changed in that run

Retention limit

Only the most recent backups per device retain a browsable tree. Older backups display a "tree not available" message

General

Enter a unique Job Name (duplicate names are rejected) and an optional Description

Source & Restore Point

Select the source device, then choose a restore point. Only devices with at least one successful backup are offered

How much is restored depends on the backup's mode:

• Full Backup: Restores the standalone system image

• Incremental Backup: Automatically verifies and replays the chain from the baseline full image to the selected increment

• Automatically restart the device: Choose whether to restart the device automatically. This option appears only for full image restore points, and it's on by default.

Target Devices

• Select one or more specific devices to write the backup onto.

• Restore supports specific devices only. You can't target groups.

• A target can be the source device itself or a different machine.

Schedule

Choose Run immediately or Run on schedule with designated date, time, and timezone

• Max Restore Duration: Set timeout limit (default: 48 hours). Devices exceeding this window fail automatically.

Stop

Stops only the devices that haven't started yet. Those devices are marked Failed, with the reason that an administrator cancelled them. Devices that are already restoring keep going, because their disk is partway through being rewritten. Before you confirm, the dialog lists the devices that will be stopped

What happens after Stop depends on whether the job has run:

• Never run: the job stays in the list as Stopped. You can edit it and start it again

• Already running: the job moves to History once its last active device finishes

Start

Re-enables a job that has never run. A job that has already run can't be started again. Re-running it could send a second restore to devices that are still rewriting their disks

Edit

Changes the job's settings. Available only when the job has no run in progress

Delete

Removes the job. Unlike backup jobs, you can delete a restore job in any state, without stopping it first

Clone

Duplicate the restore job's settings into a new job

Endpoint Backup Coverage

Every eligible device falls into exactly one of three buckets:

• Fully backed up: latest backup succeeded or partially succeeded

• Missed a recent backup: previous backup exists, but the latest attempt failed or timed out.

• Never completed a backup: Device lacks a recorded baseline backup.

Note Devices that aren't targeted by any active backup job are left out rather than counted as unprotected. If you stop the only job covering a group, that group's devices drop off the panel instead of turning red. To find devices with no backup job, use the Report.

Endpoint Backup Coverage Trend

The same three buckets over the last 14 days, one point per day. A flat line is normal for weekly backups. Days with no data appear as gaps, not zeros.

Backup Statuses

Backup runs in the timeframe: Succeeded, Partial Success, Pending, Running, Failed, and Timeout (the device never picked up the run before its window closed)

Restore Statuses

Restore runs in the timeframe: Succeeded, Pending, Running, and Failed. Timed-out and stopped restores count as Failed.

Top Backup Failure Reasons

The failure reasons devices reported, most common first. If every row shows zero, there were no classified failures in the timeframe

Needs Attention

The 10 most recent problems. The Backup tab lists failed and timed-out backup runs, and the Restore tab lists failed restore runs. There's one row per run, so a device that failed twice appears twice.

Event Types

Backup completed, Backup failed, Restore completed, Restore failed

Channel

• In-app: appears under the notification bell in the console for every administrator in the account. It has no recipient list.

• Email: sent to 1–100 addresses you enter. Recipients don't need to be console users.

Execution Rules

• Maximum of 8 rules per account (1 In-app + 1 Email per event)

• You can disable a rule without deleting it. It keeps its settings but stops sending notifications.

• Notifications generate per device (e.g., 50 devices = 50 notifications)

• In-app notifications appear immediately. Emails queues processes 10 emails every 5 minutes

Tip Use In-app for success events and Email for failure events. An Email rule on Backup completed for a large fleet sends one email per device for every run.

1. Choose a Report Type and enter a Report Name

Up to 100 characters, unique within your account

2. Choose a Generating Schedule

Every schedule runs at a fixed time, with no day or time to set:

• One time: Once at the next 00:00 UTC, then it turns itself off

• Daily: Every day at 00:00 UTC

• Weekly: Every Monday at 00:00 UTC

• Monthly: The 1st of every month at 00:00 UTC

3. Choose a Time Frame

Last 24 hours, Last 7 days, Last 30 days, or Custom Range

4. Choose the Groups to include.

Leave this empty to include all groups

5. (Optional) Turn on Share report by email

Enter:

• Recipients: one or more email addresses, separated by commas (required)

• Email Content: a message of up to 1,000 characters. A default message is filled in, and you can replace it

• Full Report Format: PDF or CSV

6. Preview and Save

Preview shows the layout of the report before you save it; Back to Form returns you to the settings.

Note Preview uses sample data. Use it to judge layout, not your own numbers.

The ⋮ menu

• View Report: Open it in the console

• Export as PDF or CSV (CSV is always a .zip archive)

• Delete: removes that run, its files and its download link; other runs and the configuration are untouched)

View and Export are only available on a Completed run

Generate Now

If Share report by email is turned on, clicking Generate Now will still email the full recipient list with a download link, even if the schedule is disabled.

Edit

Changes the report settings

Turn a schedule on or off

The schedule toggle only controls recurring automated generation; it does NOT suppress email sharing when manually triggering reports