OneDrive full synthetic backup contains files deleted month ago
Hello everyone,
My CISO has asked be to test restores of OneDrive backups and I’ve found something strange. I have incremental backups configured to run Monday to Thursday at 5:00 PM. On Friday at 5:00 PM, a synthetic full backup runs also at 5:00 PM that includes an incremental backup just before the synthetic full. The storage policy is set so the primary copy has a 14 day retention for all backups and a one year retention for Monthly full backups plus a synchronous replication to a media agent at my DR site which has the same 14 day all / 365 day monthly retention.
The weird thing is that when I do a “browse and restore” on the most recent OneDrive synthetic full backup, I see files from my OneDrive that were deleted months ago. Shouldn’t the synthetic full backup be dropping files that are no longer there?
Ken
Page 1 / 1
Hey Ken, when it comes to O365/Exchange/OneDrive, the objects will follow the O365 plan & not the storage policy/server plan. In the O365 plan, you will notice “Retain deleted items for” which means the item will be retained for that duration from the date the item was deleted. eDoc link] Let’s say the value is 365 days and item was deleted Feb 15, 2022. It will stay in the backups till Feb 15, 2023.
Likewise, just for information here, in the Exchange retention policy, where in use, there will be two retention options to choose - one is based on receive time & other based on delete time.
Hope this helps clarify!
I’m a long time customer that still uses the Java GUI. When I go into the Command Center and navigate to Manage > Plans, I only have two: “Server” and “Server backup plan”.
The “Server” plan has zero associated entities so that’s obviously not where I need to look.
“Server backup plan” has four associated entities: The three nodes of my HyperScale media agent and my email content indexing server.
I appreciate the reply but what you wrote doesn’t seem to apply to my installation.
This should be more applicable (though let me know if it doesn’t).
Thanks @Mike Struening, @Syed Q,
When I check Policies > Configuration Policies > Exchange Policies > Retention Policy > Properties, I see this:
The Corporate backup policy says that production backups will be retained for 3 years. It appears there’s a disconnect between the written policy and the actual configuration within CommVault.
Based on what you’ve said, I believe is should change the configuration from:
Retention mode: Deletion Time Based Retention
To:
Retention mode: Received Time Based Retention
Does that sound reasonable?
Ken
@Ken_H , yeah assuming you just want it kept for 3 years based on when it was received/created, then your change makes sense.
The other setting starts the ‘clock’ after a file is deleted, which is generally recommended (because it’s safer/more cautious).
Thanks @Mike Struening,
I’d like to go back to my original question about restoring OneDrive folders. Today, if I restore a folder from the most recent synthetic full backup, I am not getting a restored folder that matches the contents from last week but (apparently) a copy of the folder with all the files that have been deleted within the past 3 years. If I change to Received Time Based Deletion, will the contents of the folder that CommVault creates during the restore more closely match the actual contents from a week ago?
Ken
@Ken_H , I’ll confer with some people internally to confirm!
@Ken_H
This is assuming you are talking about v2 agents you are correct.
If you setup the agents in Command Center, its v2 also there are no synethic full backups. This is all based on the incremental forever model.
The restore will contains the data protected based on the retention, its not a ‘snapshot’ as the drive was at that exact time but would contain deleted items. Recovery point options on some agents is for a exact ‘snapshot’ or point in time. Changing to Received Time based would not change this as its just how long we will show the item in the browse based on its sent/received time. Even if it was deleted, we would still keep it for 3 years based on your screenshot.
The O365 agents are item-based retention NOT job based. All retention you configure is based on the time of each item itself.
I just did a restore of a OneDrive folder using the command center. The job completed without error yet the folder was not restored to the original location. I appreciate that everyone who’s replied to this thread is trying to help but … seriously, you would have to actively work to make this more complicated and less clear.
Question to CommVault staff: Is there a consulting package for configuring OneDrive and SharePoint online backups? CommVault treats OneDrive so much differently than a old fashioned file server that I don’t see any way for me to configure CommVault so that what it does matches the corporate backup policy.
If I restore a folder on the corporate file server from the March 25th backup, I get the files that were in that folder on March 25. But if I restore a OneDrive folder from the March 25 backup, the restored folder contains files that were deleted months or even years earlier. How does this make any sense?
@Ken_H , it might be best to open a support case for this (once you do, share the case number here).
Regarding any consulting package, I would message your Account Rep to discuss as they would know best (and if you need me to make that connection, send me a pm and I’ll be happy to help).
Update on this: It appears this is a problem with the Microsoft OneDrive synchronization that is supposed to keep C:\Users\khemmerling\OneDrive\My Documents synchronized with the actual Azure cloud storage that is backed up by CommVault. The subject on this thread references files deleted “months ago” and that appears to be how long the desktop sync has been failing. We are currently evaluating how to monitor this process to ensure if doesn’t catch any other users by surprise.
As for the restore run by the Command Center not working, I am ignoring that as I rely on the java GUI as much as possible. While there are some things that I’m forced to use the Command Center interface for, they are few and far between.
Thanks everyone for your help and your patience. It can be incredibly frustrating when systems don’t work as expected and I apologize if that frustration came through in my posts to this forum.
I’ll finish with one comment: Stupid Microsoft
Ken
All good, @Ken_H ! I imagine your final comment was quite subdued