By default, the size of the Quarantine is limited to 1024 MB. When Quarantine reaches maximum size, Kaspersky Endpoint Security stops sending the files and generates the Not enough space in Quarantine storage event. To prevent the quarantine from running out of disk space, you can set a threshold at which Kaspersky Endpoint Security generates a Quarantine storage is almost out of space event. You cannot configure a retention period for quarantined files to have them automatically removed.
If the Kaspersky Anti Targeted Attack Platform (EDR) solution is deployed in your organization, we recommend increasing the size of Quarantine. When doing a YARA scan, the application may encounter a large memory dump. If the size of the memory dump exceeds the size of Quarantine, the YARA scan finishes with an error and the memory dump is not quarantined. We recommend setting the size of Quarantine equal to the total size of the RAM on the computer (for example, 8 GB) or disabling the size limit of Quarantine.
In the Kaspersky Security Center Administration Console tree, select Policies.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select General settings → Reports and Storage.
In the Quarantine block configure the Quarantine size:
Limit the size of Quarantine toNMB. If the check box is selected, the maximum Quarantine size is limited to the defined value. By default, the maximum size is 1024 MB. When Quarantine reaches maximum size, Kaspersky Endpoint Security sends the Not enough space in Quarantine storage event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application stops quarantining new objects. You must empty the Quarantine manually.
If the check box is cleared, the Quarantine size is limited by the free disk space available.
Notify when the Quarantine storage reachesNpercent. Threshold value of the Quarantine. For example, you can set the Quarantine threshold to 50%. When Quarantine reaches the threshold, Kaspersky Endpoint Security sends the corresponding event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application continues quarantining new objects.
If this check box is cleared, the application does not generate events when the quarantine threshold is reached.
In the main window of the Web Console, select Assets (Devices) → Policies & profiles.
Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
Select the Application settings tab.
Go to General Settings → Reports and Storage.
In the Quarantine block configure the Quarantine size:
Limit the size of Quarantine toNMB. If the check box is selected, the maximum Quarantine size is limited to the defined value. By default, the maximum size is 1024 MB. When Quarantine reaches maximum size, Kaspersky Endpoint Security sends the Not enough space in Quarantine storage event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application stops quarantining new objects. You must empty the Quarantine manually.
If the check box is cleared, the Quarantine size is limited by the free disk space available.
Notify when the Quarantine storage reachesNpercent. Threshold value of the Quarantine. For example, you can set the Quarantine threshold to 50%. When Quarantine reaches the threshold, Kaspersky Endpoint Security sends the corresponding event to Kaspersky Security Center and publishes the event in Windows Event Log. Meanwhile the application continues quarantining new objects.