# Archive Configuration Manager site backups before the next snapshot replaces them

> Why is a successful Configuration Manager site-backup task insufficient evidence of multiple recovery points?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-054-archive-configuration-manager-site-backups-before-the-next-snapshot-replaces-them/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:06+00:00
- Modified: 2026-09-17T16:38:44+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why is a successful Configuration Manager site-backup task insufficient evidence of multiple recovery points?

## Potentially affected

Use this review for Configuration Manager sites using the Backup Site Server maintenance task. Identify the required recovery points and protected archive destination before changing the backup workflow.

## DSE recommendation

DSE recommends assigning a separate acceptance check to archive creation and retention.

## Article

## Source facts

The site-backup task replaces its previous snapshot on the next run rather than maintaining a series of earlier snapshots. Microsoft also warns that the old snapshot is removed before the new backup begins, so a failed task can leave no valid snapshot. A correctly placed AfterBackup.bat script is run after a successful task and can archive that completed snapshot. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/configmgr/core/servers/manage/backup-and-recovery).

## Applicability

Use this review for Configuration Manager sites using the Backup Site Server maintenance task. Identify the required recovery points and protected archive destination before changing the backup workflow.

## DSE recommendation

DSE recommends assigning a separate acceptance check to archive creation and retention. Define the required generation history, control access to its destination, and make a failed archive visible to the backup owner. Review the post-backup script as operational code, including its error handling and the protection of required credentials.

## Verification

Observe an approved backup cycle and confirm that a distinct archived recovery point is retained after a later cycle completes. Test the chosen recovery point through the organization’s approved restoration procedure. Keep backup success, archive success and restoration evidence separate so a passing maintenance task does not conceal a missing archive.

## Official references

[Microsoft Learn: Back up a Configuration Manager site](https://learn.microsoft.com/en-us/intune/configmgr/core/servers/manage/backup-and-recovery). Source reviewed September 17, 2026.

## Primary reference

- Name: Backup sites - Configuration Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/configmgr/core/servers/manage/backup-and-recovery
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Archive Configuration Manager site backups before the next snapshot replaces them,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-054-archive-configuration-manager-site-backups-before-the-next-snapshot-replaces-them/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.