Code42 console settings
Overview
This article lists settings in the Code42 console that you should use to optimize operation of your Code42 cloud environment. It lists only the highest-value settings rather than all settings in the Code42 console.
Rather than managing these settings yourself, consider having Code42 set them for you. Click here to request that Professional Services update your Code42 environment to the settings in this article.
Considerations
- You must have the Customer Cloud Admin role to apply these settings.
- The settings in this article reside at the organizational level. To apply the settings to a child organization only, ensure that you first disable inheritance from the parent organization. For example:
- To disable inheritance of all device defaults, on the Device Backup Default Settings General tab, deselect Use device defaults from parent.
- To disable inheritance of security settings for an organization, on the Organization Settings Security tab, deselect Inherit security settings from parent.
Security settings
Device backup defaults security settings
To change the following settings, navigate to the the Security tab of device backup defaults.
| Feature | Setting | Push or Lock? | Benefit |
| Auto: Require account password to access Code42 app |
Selected | Lock | Requires that the user enter the correct password to open the Code42 app. This setting helps protect backed up files from being accessed or deleted by an unauthorized user. |
| Archive Key Encryption Key | Standard | Lock |
Allows users or administrators to restore files from archives without providing an additional password. For best operation, use the Standard setting.
Lock the setting to prevent users from setting archive key passwords in the Code42 app. If users set archive key passwords, administrators can be locked out of user backup if the administrators cannot provide the passwords that users set. |
Organization security settings
To change the following settings, navigate to the Security tab of organization settings.
| Feature | Setting | Push or Lock? | Benefit |
| Web Restores | Disabled | Lock |
Prevents administrators in the organization from performing zip file web restores, thereby keeping archive data from being decrypted on the Code42 server system. This secures user data from access on the server by administrators. Use this setting if your organization adheres to NIST 800-171 compliance.
Lock the setting to prevent other administrators from changing it. |
| Client Visibility | Hidden | Lock | Removes most user-facing indications of Code42's presence from endpoints. |
General settings
To change the following settings, navigate to the the General tab of device backup defaults.
| Feature | Setting | Push or Lock? | Benefit |
| General: When user is away, use up to __ % CPU |
30 | Lock | Allows adequate CPU allocation for Code42 operations, including the the initial metadata file collection scan, without taking too many CPU resources away from other applications. |
20 |
|||
| Global Exclusions | Set to our global exclusions | Lock |
Excludes non-user files from collection in archives, such as operating system and application files. Using our global exclusions results in shorter CPU processing times and less bandwidth usage. These exclusions apply to backed up files only. Security monitoring of these files still continues.
Setting Global Exclusions excludes the files from backup no matter where the files are being backed up to, whether to local storage (for example, an external drive) or to Code42 cloud storage. Files selected with this setting are also removed from all archives.
Lock this setting to prevent users from using the Code42 app to override the global file exclusions. |
| Cloud Exclusions | None | Lock | Prevents files from being backed up only to local storage. As a result, the size of backup and restore file selections more closely match archive size in the cloud. |
| General: Preferred time for verification scan |
7 days at 12:00
|
Lock |
Runs a file verification scan at noon every seven days to check endpoints for file changes and deleted files within file backup selections. Setting the scan at noon increases the chance that the endpoints are powered on and awake.
If the scan is run during off-business hours when endpoints are typically powered off or asleep, the scan cannot run until the next time the endpoint is powered on and awake, tying up endpoint resources just when users are starting them up for their work day.
Lock this setting to prevent other administrators from changing it. (Users can still manually scan for file changes from the Code42 app.) |
Network settings
To change the following settings, navigate to the the Network tab of device backup defaults.
| Feature | Setting | Push or Lock? | Benefit |
| Sending Limits: Limit sending rate when away to |
5 Mbps | Push |
Allows adequate network bandwidth for Code42 operations without taking too much bandwidth away from other processes. Do not set to None because it can result in Code42 operations sometimes inordinately slowing network speeds for other processes.
Push the setting rather than lock it to allow administrators of child organizations to adjust the setting as needed for their organizations. |
| Sending Limits: Limit sending rate when present to |
5 Mbps |
Backup settings
To change the following settings, navigate to the the Backup tab of device backup defaults.
| Feature | Setting | Push or Lock? | Benefit |
| File selection: Included files | :allusers | Lock |
Backs up all files in all users' home folders through use of the
Lock this setting to prevent users from removing folders or files from file selection in the Code42 app. |
| Unselected | Lock |
Removes all pause controls from the Code42 app, thereby preventing users from pausing backups and downloads of files, including files under legal hold. Preventing pausing of backups ensures more complete sets of backup files, because every time a backup is paused, it can result in some files being missed in the process.
Lock the setting to prevent other administrators from changing it. |
|
| Frequency and versions: Remove deleted files |
90 days | Lock | Removes deleted files from backups after 90 days. |
Global exclusions
You should exclude operating system files, application files, and the like from being backed up, since users don't directly interact with these files and they can be restored by reinstalling the operating system or application. Set Global Exclusions to exclude the following files.
(?i)^.*(\.class|-journal|\.Win386\.SWP|PM_HIBER\.BIN|SAVE2DSK\.BIN|SYSTEM\.DAT|TOSHIBER\.DAT|Thumbs\.db|USER\.DAT|\.bck|\.bkf|\.cdt|\.hdd|\.hds|\.icloud|\.ini|\.lrprev|\.manifest|\.mum|\.nib|\.nvram|\.ost|\.part|\.pvm|\.pvs|\.rbf|\.tibx?|\.tmp|\.upd|\.avhdx|\.vdi|\.vfd|\.vhd|\.vhdx|\.vmc|\.vmdk|\.vmem|\.vmsd|\.vmsn|\.vmss|\.vmtm|\.vmwarevm|\.vmx|\.vmxf|\.vsv|\.vud|\.xva|memory\.dmp|/Lightroom.*Previews\.lrdata|\.sparsebundle|\.sparseimage|/(cookies|permissions)\.sqlite(-.{3})?|\.crdownload)$
(?i)^.*(/Apple.*/Installer Cache/|/Cache/|/Cookies/|/Music/Subscription/|/Plex Media Server/|/Steam/|/Temp/|/\.dropbox\.cache/|/\.git/|/iPod Photo Cache/|/node_modules/|/tmp/|/tsm_images/|\.Trash|\.hdd/|\.pvm/|\.cprestoretmp|\.nvm|\.npm|/\.gradle/).*
linux:(?i)^/(usr/(?!($|local/$|local/crashplan/$|local/crashplan/print_job_data/.*))|opt/|etc/|dev/|home/[^/]+/\.config/google-chrome/|home/[^/]+/\.mozilla/|sbin/).*
linux:^/(cdrom/|dev/fd/|devices/|dvdrom/|initrd/|kernel/|lost\+found/|proc/|run/|selinux/|srv/|sys/|system/|var/(:?run|lock|spool|tmp|cache)/|proc/).*
linux:^/lib/modules/.*/volatile/\.mounted
mac:(?i)^.*(/iTunes/Album Artwork/Cache/|/Network Trash Folder/|/Photos Library.*/Thumbnails/|/backups\.backupdb/|/iP.* Software Updates/|/iPhoto Library.*/Thumbnails/|/iPhoto Library/iPod Photo Cache|/migratedphotolibrary/Thumbnails/|\.imovielibrary/.*/Analysis Files/|\.imovielibrary/.*/Render Files/).*
mac:^.*(/Trash/|/\.fcpcache/|MobileBackups/|\.Spotlight-.*/|\.fseventsd|\.hotfiles\.btree|/bin/|/home/|/sbin/|/cores/|/private/|/var/).*
mac:(?i)^.*(\.imovielibrary/\.lock)$
mac:(?i)^.*(\.DS_Store|\.plist|\.strings)$
mac:(?i)^/(usr/|opt/|etc/|var/|Users/((?!XCode).)*/Applications/|Users/Shared/|dev/|Library/(?!($|Application Support/$|Application Support/CrashPlan/$|Application Support/CrashPlan/print_job_data/.*))|proc/|/Users/.*/.vscode/extensions/).*
mac:^/(Applications/|Desktop DB|Desktop DF|Network/|Previous Systems|System/|Users/.*/\.cisco/vpn/log/|Users/.*/\.dropbox/|Users/[^/]+/Library/|\.DocumentRevisions-V100/|\.PKInstallSandboxManager-SystemSoftware|\.adobeTemp/|\.vol/|afs/|automount/|lost\+found/|net/).*
win:(?i)^.*(/I386|/System Volume Information/|/Temporary Internet Files/|/Windows Update Setup Files/|\$RECYCLE\.BIN/|/NTUSER|/Safari/Library/Caches/|/Windows Defender/|/cygwin(64)?/(bin|dev|etc|lib|sbin|tmp|var|usr)/|UsrClass\.dat).*
win:^.*(/Local Settings/Temp|/Local.*/History/|/LocalService/|/MSOCache|/NetHood/|/NetworkService/).*
win:(?i)^.*(/pagefile\.sys|\.etl|\.mui)$
win:(?i)^.:/(Recovery/|boot/|ESD/|Recycler/|Dell/|Intel/|Oracle/|PerfLogs/|Program Files( \(x86\))?/|ProgramData/(?!$|CrashPlan/$|CrashPlan/user_settings/)|Users/All Users/|Users/[^/]+/AppData/|Users/[^/]+/Apple/MobileSync/|Windows(\.old)?/|\$WINDOWS.~(BT|WS)/|\$SysReset/|\$GetCurrent/|_RESTORE/|_SMSTaskSequence/|safeboot/|swsetup/).*
win:(?i)^.:/(Config\.Msi|HIBERFIL\.SYS|HIBRN8\.DAT|autoexec\.bat|boot\.ini|bootmgr|bootnxt|bootsect\.bak|config\.sys|io\.sys|msdos\.sys|ntdetect\.com|ntldr|swapfile\.sys)$
(?i)^.*(\.kgdb|\.db|\.srd|-shm|-wal|-lock|\.musicdb|\.tvdb|\.pid)$
(?i)^.*\.photoslibrary/(private/|resources/|database/).*$
(?i)^.*/(.*\.?leveldb)/.*$