How to properly organize a backup of user data?

Question

Backup

The ransomware virus passed, the authorities finally thought about backup.
I plan to put a 3-4 TB disk in some computer, screw Linux there and distribute this disk with Samba.
On the user system, set up a standard Windows backup to a network folder.
What can be pitfalls?
How can you protect a network folder from viruses and users (so that no one climbs except backup)?
Is it possible to set up a backup on one user, and work under another?
The organization has about 50 computers, all Windows 7. There are no domains.

Answer 1

Look aside with agents on client PCs to run the agent under the local admin, and already specify in the northern part what to store for how long, etc.

Answer 2

If the user has write access to this directory, the Trojan will get there with all the consequences. If your backup will consist of only one "cast" - after encryption, you have every chance to overwrite all the information with garbage.

Answer 3

from the ransomware, enabling a shadow copy (see previous versions) on client computers helps a lot.
To centrally backup jobs outside the domain - it is better to create accounts on all machines for access from the network and collect data from the central machine (backup).

Answer 4

1. Do not keep, in principle, any business data on users' computers, keep them on a file server.
2. Archive them to another computer (another disk), to which users do not have access.
3. Make a complete archive once a month, say, and once a day (once an hour) - differential copies.
4. Shadow copies are good too.
5. In addition to the Nightly Backups, the Super Flexible File Synchronizer has proven itself well: it makes copies of fresh versions of files once an hour while preserving the old ones.

Answer 5

If you keep a backup only for the previous day, there is a high probability that a virus that was not noticed at the time will also be in the backup.
A good scheme was offered at one time by 1C:
- for the last week, store backups for every day
- for the past month - for a backup at the end of each week of the past month
- for the past year - for a backup for the end of each month of the past year