Optimize Code42 console settings for the backup agent


This article lists Code42 console settings to optimize performance for devices with the backup agent. It lists only the highest-value settings rather than all settings in the Code42 console.

Let Code42 implement Code42 console settings
Rather than managing these settings yourself, consider having Code42 set them for you. Click here to request that Professional Services update your Code42 environment to the settings in this article. 


  • You must have the Customer Cloud Admin role to apply these settings.
  • The settings in this article reside at the organizational level. To apply the settings to a child organization only, ensure that you first disable inheritance from the parent organization. For example:
    • To disable inheritance of all device defaults, on the Device Backup Default Settings General tab, deselect Use device defaults from parent.
    • To disable inheritance of security settings for an organization, on the Organization Settings Security tab, deselect Inherit security settings from parent.
  • These settings do not apply to the insider risk agent.

Security settings

Device backup defaults security settings

To change the following settings, navigate to the the Security tab of device backup defaults.

Feature Setting Push or Lock? Benefit
Require account password to access Code42 app
Selected Lock Requires that the user enter the correct password to open the Code42 agent. This setting helps protect backed up files from being accessed or deleted by an unauthorized user.
Archive Key Encryption Key Standard Lock

Allows users or administrators to restore files from archives without providing an additional password. For best operation, use the Standard setting. 


Lock the setting to prevent users from setting archive key passwords in the Code42 agent. If users set archive key passwords, administrators can be locked out of user backup if the administrators cannot provide the passwords that users set.

Organization security settings

To change the following settings, navigate to the Security tab of organization settings. 

Feature Setting Push or Lock? Benefit
Web Restores Disabled Lock

Prevents administrators in the organization from performing zip file web restores, thereby keeping archive data from being decrypted on the Code42 server system. This secures user data from access on the server by administrators. Use this setting if your organization adheres to NIST 800-171 compliance


Lock the setting to prevent other administrators from changing it.

Client Visibility Hidden Lock Removes most user-facing indications of Code42's presence from endpoints. 

General settings

To change the following settings, navigate to the the General tab of device backup defaults.

Feature Setting Push or Lock? Benefit
When user is away, use up to __ % CPU
30 Lock Allows adequate CPU allocation for Code42 operations, including the the initial metadata file collection scan, without taking too many CPU resources away from other applications.

When user is present, use up to __ % CPU

Global Exclusions Set to our global exclusions Lock

Excludes non-user files from collection in archives, such as operating system and application files. Using our global exclusions results in shorter CPU processing times and less bandwidth usage. These exclusions apply to backed up files only. Security monitoring of these files still continues. 


Setting Global Exclusions excludes the files from backup no matter where the files are being backed up to, whether to local storage (for example, an external drive) or to Code42 cloud storage. Files selected with this setting are also removed from all archives.


Lock this setting to prevent users from using the Code42 agent to override the global file exclusions.

Cloud Exclusions None Lock Prevents files from being backed up only to local storage. As a result, the size of backup and restore file selections more closely match archive size in the cloud. 
Preferred time for verification scan

7 days at 12:00



Runs a file verification scan at noon every seven days to check endpoints for file changes and deleted files within file backup selections. Setting the scan at noon increases the chance that the endpoints are powered on and awake.


If the scan is run during off-business hours when endpoints are typically powered off or asleep, the scan cannot run until the next time the endpoint is powered on and awake, tying up endpoint resources just when users are starting them up for their work day.


Lock this setting to prevent other administrators from changing it. (Users can still manually scan for file changes from the Code42 agent.) 

Network settings

To change the following settings, navigate to the the Network tab of device backup defaults.

Feature Setting Push or Lock? Benefit
Sending Limits:
Limit sending rate when away to
5 Mbps Push

Allows adequate network bandwidth for Code42 operations without taking too much bandwidth away from other processes. Do not set to None because it can result in Code42 operations sometimes inordinately slowing network speeds for other processes.


Push the setting rather than lock it to allow administrators of child organizations to adjust the setting as needed for their organizations.

Sending Limits:
Limit sending rate when present to
5 Mbps

Backup settings

To change the following settings, navigate to the the Backup tab of device backup defaults.

Feature Setting Push or Lock? Benefit
File selection: Included files :allusers Lock

Backs up all files in all users' home folders through use of the :allusers substitution variable. Backups include the parent Users folder:

  • Windows: C:\Users\ 
  • Mac /Users/ 
  • Linux: /home/ 

To help prevent data loss and mitigate potential security issues, lock this setting to block users from changing the file selection in the Code42 agent.

Pausing Controls:
Allow pausing of:

Unselected Lock

Removes all pause controls from the Code42 agent, thereby preventing users from pausing backups and downloads of files, including files under legal hold. Preventing pausing of backups ensures more complete sets of backup files, because every time a backup is paused, it can result in some files being missed in the process.


Lock the setting to prevent other administrators from changing it.

Frequency and versions:
Remove deleted files
90 days Lock Removes deleted files from backups after 90 days. 

Global exclusions

Code42 automatically excludes many non-user files from backups, including most operating system, application, and temporary files. As of mid-December, 2023, files over 10 GB are also excluded by default.

Previous recommendations are now automatic defaults
Prior to April 15, 2023, you may have applied a list of exclusions as part of Code42's recommendations for optimizing performance. Now, this list of Files excluded from backup by default is applied automatically. If your list of global exclusions contains any of the items listed in the Code42 defaults, you can remove them to optimize agent performance.

Only add Global Exclusions for additional items you want to exclude that are not listed in the Code42 defaults.

Related topics