By default, the size of the Quarantine is limited to 200 MB. After the maximum size is reached, Kaspersky Endpoint Security automatically deletes the oldest files from the Quarantine.
If the Kaspersky Anti Targeted Attack Platform (EDR) solution is deployed in your organization, we recommend increasing the size of Quarantine. When doing a YARA scan, the application may encounter a large memory dump. If the size of the memory dump exceeds the size of Quarantine, the YARA scan finishes with an error and the memory dump is not quarantined. We recommend setting the size of Quarantine equal to the total size of the RAM on the computer (for example, 8 GB).
Open the Kaspersky Security Center Administration Console.
In the console tree, select Policies.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select General settings → Reports and Storage.
In the Quarantine block configure the Quarantine size:
Limit the size of Quarantine toNMB. Maximum Quarantine size in MB. For example, you can set the maximum Quarantine size to 200 MB. When Quarantine reaches maximum size, Kaspersky Endpoint Security sends the corresponding event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application stops quarantining new objects. You must empty the Quarantine manually.
Notify when the Quarantine storage reachesNpercent. Threshold value of the Quarantine. For example, you can set the Quarantine threshold to 50%. When Quarantine reaches the threshold, Kaspersky Endpoint Security sends the corresponding event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application continues quarantining new objects.
In the main window of the Web Console, select Devices → Policies & profiles.
Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
Select the Application settings tab.
Go to General settings → Reports and Storage.
In the Quarantine block configure the Quarantine size:
Limit the size of Quarantine toNMB. Maximum Quarantine size in MB. For example, you can set the maximum Quarantine size to 200 MB. When Quarantine reaches maximum size, Kaspersky Endpoint Security sends the corresponding event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application stops quarantining new objects. You must empty the Quarantine manually.
Notify when the Quarantine storage reachesNpercent. Threshold value of the Quarantine. For example, you can set the Quarantine threshold to 50%. When Quarantine reaches the threshold, Kaspersky Endpoint Security sends the corresponding event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application continues quarantining new objects.
